Habilidades dbs-video-extract

📦

dbs-video-extract

Name: dbs-video-extract
Author: dontbesilent2025

Revisión del contenido r1 Seguro 📁 Acceso al sistema de archivos🔑 Variables de entorno⚙️ Comandos externos🌐 Acceso a red

Extract Short-Video Data and Speech Transcripts

Short-video links often separate useful metadata from spoken content. This skill combines TikHub data queries and Qingdou transcription, then saves transcripts as organized Markdown files.

Compatible con: Claude Codex Code(CC)

🥈 80 Plata

Maintain this Skill? Claim it 🥈 80 Plata

Instalar con mi Agente

Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.

Solicitud de agente

Review the Skillstore skill "dbs-video-extract" from https://skillstore.io/skills/dontbesilent2025-dbs-video-extract.md and its manifest at https://skillstore.io/api/skills/dontbesilent2025-dbs-video-extract/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.

Recursos legibles por agentes

Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.

Detalle Markdown GET /skills/dontbesilent2025-dbs-video-extract.md Manifest firmado GET /api/skills/dontbesilent2025-dbs-video-extract/manifest Lockfile firmado GET /api/skills/dontbesilent2025-dbs-video-extract/lockfile

Pruébalo

Usando "dbs-video-extract". Check readiness when only TikHub is configured.

Resultado esperado:

TikHub credentials are configured. Metadata queries are available; speech transcription requires Qingdou credentials. This local check does not validate authentication, balance, or service availability.

Usando "dbs-video-extract". Illustrative successful extraction of a public video titled Morning Routine by Sample Creator.

Resultado esperado:

Metadata query: successful. Available author, title, and engagement fields are included in the summary.
Speech transcript: saved under the selected output directory in Sample Creator/Morning Routine.md.
The Markdown file includes source metadata and the returned transcript.

Usando "dbs-video-extract". Illustrative combined extraction where metadata succeeds but transcription reports insufficient resources.

Resultado esperado:

Partial success: metadata was retained. Qingdou transcription failed because the provider reported insufficient resources. No transcript file was created.

Auditoría de seguridad

Seguro

v1 • 17/10/2026 Abrir el informe versionado

Most static flags reflect documented credential handling, Markdown syntax, or platform identifiers rather than malicious behavior. Confirmed risks concern credential-bearing redirects, HTTP endpoint overrides, and unrestricted URL resolution; seven static locations cover these three issues. No evidence found of malicious intent or prompt injection in the reviewed files.

Archivos escaneados

2,224

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Elementos de revisión de capacidades (7)

Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.

Medio

scripts/extract_video_transcript.py:158

Python HTTP libraries

with urllib.request.urlopen(request, timeout=30) as response:

Default urllib redirects retain the x-api-key header across hosts and HTTPS downgrades. A malicious service redirect can disclose the Qingdou credential.

Medio

scripts/extract_video_transcript.py:410

Python environment access

base_url = os.environ.get("QINGDOU_BASE_URL", DEFAULT_BASE_URL).strip()

QINGDOU_BASE_URL reaches authenticated requests without HTTPS validation. An HTTP override exposes the API key and submitted share text to network observers.

Medio

scripts/extract_video.py:231

Python environment access

base_url = os.environ.get(

The combined workflow accepts QINGDOU_BASE_URL without validating its scheme before sending the API key. An HTTP override transmits credentials without TLS.

Medio

scripts/tikhub_api.py:206

Python HTTP libraries

with urllib.request.urlopen(request, timeout=max(1.0, timeout)) as response:

The REST request follows redirects with its Authorization header intact. A cross-host or HTTP redirect can disclose the TikHub bearer token.

Medio

scripts/tikhub_api.py:289

Python HTTP libraries

with urllib.request.urlopen(request, timeout=max(1.0, timeout)) as response:

MCP requests use default redirect handling, which preserves Authorization across origins. A malicious endpoint redirect can disclose the bearer token and session header.

Medio

scripts/tikhub_api.py:415

Python HTTP libraries

request = urllib.request.Request(

The standalone Douyin command constructs a GET from any extracted HTTP URL before checking its platform. Untrusted share text can target internal services.

Medio

scripts/tikhub_api.py:426

Python HTTP libraries

with urllib.request.urlopen(request, timeout=max(1.0, timeout)) as response:

The resolver follows redirects without host or private-address checks. Untrusted input or redirect destinations can cause requests to loopback or internal services.

Factores de riesgo

📁 Acceso al sistema de archivos (11)

references/api-setup.md:91 references/api-setup.md:102 references/api-setup.md:91 references/api-setup.md:102 scripts/configure_api_key.py:40 scripts/configure_api_key.py:40 scripts/configure_api_key.py:10 scripts/configure_api_key.py:61 scripts/configure_api_key.py:66 SKILL.md:107 SKILL.md:107

🔑 Variables de entorno (50)

⚙️ Comandos externos (31)

🌐 Acceso a red (17)

scripts/extract_video_transcript.py:15 scripts/extract_video_transcript.py:146 scripts/extract_video_transcript.py:158 scripts/extract_video_transcript.py:21 scripts/extract_video.py:27 scripts/extract_video.py:28 scripts/tikhub_api.py:14 scripts/tikhub_api.py:196 scripts/tikhub_api.py:206 scripts/tikhub_api.py:282 scripts/tikhub_api.py:289 scripts/tikhub_api.py:415 scripts/tikhub_api.py:426 scripts/tikhub_api.py:19 scripts/tikhub_api.py:21 scripts/tikhub_api.py:22 scripts/tikhub_api.py:23

Auditado por: codex

Compartir y citar este informe

Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.

Abrir el informe versionado

Copiar enlace del informe

https://skillstore.io/skills/dontbesilent2025-dbs-video-extract/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Insignia Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/dontbesilent2025-dbs-video-extract/security.svg)](https://skillstore.io/skills/dontbesilent2025-dbs-video-extract?utm_source=security_passport_badge)

Insignia HTML

<a href="https://skillstore.io/skills/dontbesilent2025-dbs-video-extract?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/dontbesilent2025-dbs-video-extract/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Tarjeta para insertar

<iframe src="https://skillstore.io/embed/skills/dontbesilent2025-dbs-video-extract.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citas académicas (APA · BibTeX · CFF)

Cita APA

dontbesilent2025. (2026). dbs-video-extract security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/dontbesilent2025-dbs-video-extract/audits/1

Cita BibTeX

@techreport{dontbesilent2025-dontbesilent2025-dbs-video-extract-2026,
  author = {dontbesilent2025},
  title = {dbs-video-extract security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/dontbesilent2025-dbs-video-extract/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "dbs-video-extract security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "dontbesilent2025"
date-released: "2026-10-17"
url: "https://skillstore.io/skills/dontbesilent2025-dbs-video-extract/audits/1"
identifiers:
  - type: other
    value: "skillstore:dontbesilent2025-dbs-video-extract:audit:1"
    description: "Skillstore immutable audit report identifier"

Puntuación de Skillstore

Por qué esta puntuación Confianza de la evidencia: Medio

Arquitectura

Mantenibilidad

Contenido

Comunidad

Cumplimiento de la especificación

Lo que puedes crear

Archive source material

Save spoken content and source metadata from permitted public videos into an organized Markdown research archive.

Inspect short-video performance

Retrieve available engagement statistics and author details without requesting transcription when only metadata is needed.

Review published speech

Extract a transcript from a published video for manual editorial review while retaining the original service output.

Prueba estos prompts

Check readiness

Check which credentials are configured for dbs-video-extract. Report available capabilities without showing secrets or making network requests.

Extract one transcript

Extract only the speech transcript from [video share text]. Save it under [output directory] and report the resulting Markdown path.

Combine data and speech

Extract metadata and speech from [video share text] into [output directory]. Preserve either successful result if one service fails, and report limitations.

Control extraction and regeneration

Process [Douyin video share text] in combined mode using stdin. Prefer App data with Web fallback, retain raw metadata, and preserve existing transcripts.

Mejores prácticas

Configure credentials through the hidden-input helper and keep keys out of chat, repositories, and logs.
Review provider charges and use only content you are authorized to process.
Pass share text through stdin, keep default HTTPS endpoints, and preserve existing transcripts unless regeneration is explicitly required.

Evitar

Treating credential discovery as proof of valid authentication, sufficient balance, or working provider access.
Requesting media downloads, local video rendering, or offline transcription from this extraction skill.
Using untrusted endpoint overrides or assuming arbitrary links and redirects are safe.