Skills
Navigate
skills/t0ugh/videoclaw/video-publish-douyin/Gen Agent Trust Hub

video-publish-douyin

Warn

Audited by Gen Agent Trust Hub on Sep 26, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the videoclaw package via uvx. This package is an external dependency downloaded from a public registry and is not verified as a trusted source.
  • [COMMAND_EXECUTION]: The skill relies on executing the videoclaw command-line tool to perform sensitive actions such as account authentication and video uploads to the Douyin platform.
  • [INDIRECT_PROMPT_INJECTION]: The skill accepts user-supplied strings for titles and tags which are directly interpolated into shell command arguments. Ingestion points: User-provided title and tags in SKILL.md. Boundary markers: None. Capability inventory: Subprocess execution via the videoclaw CLI. Sanitization: No explicit sanitization or escaping of shell meta-characters is mentioned or implemented in the prompt templates.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 26, 2026, 10:13 AM