The Agent Skills Directory

[COMMAND_EXECUTION]: The CLI tool (packages/cli/src/auth.ts) executes platform-specific shell commands to open the system browser during the device authentication flow. This is triggered only by the user-initiated 'login' command.
[COMMAND_EXECUTION]: The tool performs file system operations (packages/cli/src/config.ts, packages/cli/src/commands/exports.ts) to store credentials and export results. It uses security best practices including atomic writes via temporary files, owner-only file permissions (0o600), and directory restrictions (0o700).
[EXTERNAL_DOWNLOADS]: The skill leverages the official exportdou package via npx. Integrity is managed by the npm registry, and the project includes a validation script (scripts/check-public-registry.mjs) to ensure dependencies are sourced from the public registry.
[DATA_EXFILTRATION]: The CLI transmits authentication tokens and user-provided video links to the official API at exportdou.cn. Data transmission is performed over HTTPS using standard headers.
[PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection as it ingests untrusted Douyin comment data. Findings: Ingestion points: Comments are retrieved via the 'preview' and 'download' commands; Boundary markers: None identified; Capability inventory: File system access and network requests are possible via the CLI tool; Sanitization: No content sanitization is performed on the raw comments before presentation to the agent.

exportdou