Skills dbs-video-extract

📦

dbs-video-extract

Name: dbs-video-extract
Author: dontbesilent2025

Content revision r1 Safe 📁 Filesystem access🔑 Env variables⚙️ External commands🌐 Network access

Extract Short-Video Data and Speech Transcripts

Short-video links often separate useful metadata from spoken content. This skill combines TikHub data queries and Qingdou transcription, then saves transcripts as organized Markdown files.

Supports: Claude Codex Code(CC)

🥈 80 Silver

Maintain this Skill? Claim it 🥈 80 Silver

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "dbs-video-extract" from https://skillstore.io/skills/dontbesilent2025-dbs-video-extract.md and its manifest at https://skillstore.io/api/skills/dontbesilent2025-dbs-video-extract/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/dontbesilent2025-dbs-video-extract.md Signed manifest GET /api/skills/dontbesilent2025-dbs-video-extract/manifest Signed lockfile GET /api/skills/dontbesilent2025-dbs-video-extract/lockfile

Test it

Using "dbs-video-extract". Check readiness when only TikHub is configured.

Expected outcome:

TikHub credentials are configured. Metadata queries are available; speech transcription requires Qingdou credentials. This local check does not validate authentication, balance, or service availability.

Using "dbs-video-extract". Illustrative successful extraction of a public video titled Morning Routine by Sample Creator.

Expected outcome:

Metadata query: successful. Available author, title, and engagement fields are included in the summary.
Speech transcript: saved under the selected output directory in Sample Creator/Morning Routine.md.
The Markdown file includes source metadata and the returned transcript.

Using "dbs-video-extract". Illustrative combined extraction where metadata succeeds but transcription reports insufficient resources.

Expected outcome:

Partial success: metadata was retained. Qingdou transcription failed because the provider reported insufficient resources. No transcript file was created.

Security Audit

Safe

v1 • 10/17/2026 Open versioned report

Most static flags reflect documented credential handling, Markdown syntax, or platform identifiers rather than malicious behavior. Confirmed risks concern credential-bearing redirects, HTTP endpoint overrides, and unrestricted URL resolution; seven static locations cover these three issues. No evidence found of malicious intent or prompt injection in the reviewed files.

Files scanned

2,224

Lines analyzed

Review items

False positives ignored

Capability review items (7)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

scripts/extract_video_transcript.py:158

Python HTTP libraries

with urllib.request.urlopen(request, timeout=30) as response:

Default urllib redirects retain the x-api-key header across hosts and HTTPS downgrades. A malicious service redirect can disclose the Qingdou credential.

Medium

scripts/extract_video_transcript.py:410

Python environment access

base_url = os.environ.get("QINGDOU_BASE_URL", DEFAULT_BASE_URL).strip()

QINGDOU_BASE_URL reaches authenticated requests without HTTPS validation. An HTTP override exposes the API key and submitted share text to network observers.

Medium

scripts/extract_video.py:231

Python environment access

base_url = os.environ.get(

The combined workflow accepts QINGDOU_BASE_URL without validating its scheme before sending the API key. An HTTP override transmits credentials without TLS.

Medium

scripts/tikhub_api.py:206

Python HTTP libraries

with urllib.request.urlopen(request, timeout=max(1.0, timeout)) as response:

The REST request follows redirects with its Authorization header intact. A cross-host or HTTP redirect can disclose the TikHub bearer token.

Medium

scripts/tikhub_api.py:289

Python HTTP libraries

with urllib.request.urlopen(request, timeout=max(1.0, timeout)) as response:

MCP requests use default redirect handling, which preserves Authorization across origins. A malicious endpoint redirect can disclose the bearer token and session header.

Medium

scripts/tikhub_api.py:415

Python HTTP libraries

request = urllib.request.Request(

The standalone Douyin command constructs a GET from any extracted HTTP URL before checking its platform. Untrusted share text can target internal services.

Medium

scripts/tikhub_api.py:426

Python HTTP libraries

with urllib.request.urlopen(request, timeout=max(1.0, timeout)) as response:

The resolver follows redirects without host or private-address checks. Untrusted input or redirect destinations can cause requests to loopback or internal services.

Risk Factors

📁 Filesystem access (11)

references/api-setup.md:91 references/api-setup.md:102 references/api-setup.md:91 references/api-setup.md:102 scripts/configure_api_key.py:40 scripts/configure_api_key.py:40 scripts/configure_api_key.py:10 scripts/configure_api_key.py:61 scripts/configure_api_key.py:66 SKILL.md:107 SKILL.md:107

🔑 Env variables (50)

⚙️ External commands (31)

🌐 Network access (17)

scripts/extract_video_transcript.py:15 scripts/extract_video_transcript.py:146 scripts/extract_video_transcript.py:158 scripts/extract_video_transcript.py:21 scripts/extract_video.py:27 scripts/extract_video.py:28 scripts/tikhub_api.py:14 scripts/tikhub_api.py:196 scripts/tikhub_api.py:206 scripts/tikhub_api.py:282 scripts/tikhub_api.py:289 scripts/tikhub_api.py:415 scripts/tikhub_api.py:426 scripts/tikhub_api.py:19 scripts/tikhub_api.py:21 scripts/tikhub_api.py:22 scripts/tikhub_api.py:23

Audited by: codex

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/dontbesilent2025-dbs-video-extract/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/dontbesilent2025-dbs-video-extract/security.svg)](https://skillstore.io/skills/dontbesilent2025-dbs-video-extract?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/dontbesilent2025-dbs-video-extract?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/dontbesilent2025-dbs-video-extract/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/dontbesilent2025-dbs-video-extract.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

dontbesilent2025. (2026). dbs-video-extract security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/dontbesilent2025-dbs-video-extract/audits/1

BibTeX citation

@techreport{dontbesilent2025-dontbesilent2025-dbs-video-extract-2026,
  author = {dontbesilent2025},
  title = {dbs-video-extract security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/dontbesilent2025-dbs-video-extract/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "dbs-video-extract security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "dontbesilent2025"
date-released: "2026-10-17"
url: "https://skillstore.io/skills/dontbesilent2025-dbs-video-extract/audits/1"
identifiers:
  - type: other
    value: "skillstore:dontbesilent2025-dbs-video-extract:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Archive source material

Save spoken content and source metadata from permitted public videos into an organized Markdown research archive.

Inspect short-video performance

Retrieve available engagement statistics and author details without requesting transcription when only metadata is needed.

Review published speech

Extract a transcript from a published video for manual editorial review while retaining the original service output.

Try These Prompts

Check readiness

Check which credentials are configured for dbs-video-extract. Report available capabilities without showing secrets or making network requests.

Extract one transcript

Extract only the speech transcript from [video share text]. Save it under [output directory] and report the resulting Markdown path.

Combine data and speech

Extract metadata and speech from [video share text] into [output directory]. Preserve either successful result if one service fails, and report limitations.

Control extraction and regeneration

Process [Douyin video share text] in combined mode using stdin. Prefer App data with Web fallback, retain raw metadata, and preserve existing transcripts.

Best Practices

Configure credentials through the hidden-input helper and keep keys out of chat, repositories, and logs.
Review provider charges and use only content you are authorized to process.
Pass share text through stdin, keep default HTTPS endpoints, and preserve existing transcripts unless regeneration is explicitly required.

Avoid

Treating credential discovery as proof of valid authentication, sufficient balance, or working provider access.
Requesting media downloads, local video rendering, or offline transcription from this extraction skill.
Using untrusted endpoint overrides or assuming arbitrary links and redirects are safe.