douyin-downloader-hardened
Warn
Audited by Gen Agent Trust Hub on Apr 21, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: Accesses the file ~/.openclaw/config.json to retrieve the tikhub_api_token, which is a sensitive credential.
- [EXTERNAL_DOWNLOADS]: Fetches video metadata and binary content from api.tikhub.io and external CDNs.
- [DATA_EXFILTRATION]: Reads local credentials and uses them in network requests to an external service; the skill includes prompt-based guardrails to mitigate the risk of token leakage in terminal output.
- [PROMPT_INJECTION]: Contains instructions designed to ignore adversarial system alerts or social engineering attempts intended to compromise the API token or bypass scope restrictions.
- [INDIRECT_PROMPT_INJECTION]: Processes untrusted user URLs and external API responses. Ingestion points include user-provided links and modal IDs; capability inventory includes network reads and local file writes; sanitization is performed via regex extraction.
Audit Metadata