技能 dbs-video-extract

📦

dbs-video-extract

Name: dbs-video-extract
Author: dontbesilent2025

內容修訂 r1 安全 📁 檔案系統存取🔑 環境變數⚙️ 外部命令🌐 網路存取

Extract Short-Video Data and Speech Transcripts

Short-video links often separate useful metadata from spoken content. This skill combines TikHub data queries and Qingdou transcription, then saves transcripts as organized Markdown files.

支援: Claude Codex Code(CC)

🥈 80 銀級

Maintain this Skill? Claim it 🥈 80 銀級

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求

Review the Skillstore skill "dbs-video-extract" from https://skillstore.io/skills/dontbesilent2025-dbs-video-extract.md and its manifest at https://skillstore.io/api/skills/dontbesilent2025-dbs-video-extract/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/dontbesilent2025-dbs-video-extract.md 已簽名 manifest GET /api/skills/dontbesilent2025-dbs-video-extract/manifest 已簽名 lockfile GET /api/skills/dontbesilent2025-dbs-video-extract/lockfile

測試它

正在使用「dbs-video-extract」。 Check readiness when only TikHub is configured.

預期結果:

TikHub credentials are configured. Metadata queries are available; speech transcription requires Qingdou credentials. This local check does not validate authentication, balance, or service availability.

正在使用「dbs-video-extract」。 Illustrative successful extraction of a public video titled Morning Routine by Sample Creator.

預期結果:

Metadata query: successful. Available author, title, and engagement fields are included in the summary.
Speech transcript: saved under the selected output directory in Sample Creator/Morning Routine.md.
The Markdown file includes source metadata and the returned transcript.

正在使用「dbs-video-extract」。 Illustrative combined extraction where metadata succeeds but transcription reports insufficient resources.

預期結果:

Partial success: metadata was retained. Qingdou transcription failed because the provider reported insufficient resources. No transcript file was created.

安全審計

安全

v1 • 2026/10/17 開啟版本化報告

Most static flags reflect documented credential handling, Markdown syntax, or platform identifiers rather than malicious behavior. Confirmed risks concern credential-bearing redirects, HTTP endpoint overrides, and unrestricted URL resolution; seven static locations cover these three issues. No evidence found of malicious intent or prompt injection in the reviewed files.

已掃描檔案

2,224

分析行數

複核項目

已忽略的誤報

能力複核項目 (7)

這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。

中

scripts/extract_video_transcript.py:158

Python HTTP libraries

with urllib.request.urlopen(request, timeout=30) as response:

Default urllib redirects retain the x-api-key header across hosts and HTTPS downgrades. A malicious service redirect can disclose the Qingdou credential.

中

scripts/extract_video_transcript.py:410

Python environment access

base_url = os.environ.get("QINGDOU_BASE_URL", DEFAULT_BASE_URL).strip()

QINGDOU_BASE_URL reaches authenticated requests without HTTPS validation. An HTTP override exposes the API key and submitted share text to network observers.

中

scripts/extract_video.py:231

Python environment access

base_url = os.environ.get(

The combined workflow accepts QINGDOU_BASE_URL without validating its scheme before sending the API key. An HTTP override transmits credentials without TLS.

中

scripts/tikhub_api.py:206

Python HTTP libraries

with urllib.request.urlopen(request, timeout=max(1.0, timeout)) as response:

The REST request follows redirects with its Authorization header intact. A cross-host or HTTP redirect can disclose the TikHub bearer token.

中

scripts/tikhub_api.py:289

Python HTTP libraries

with urllib.request.urlopen(request, timeout=max(1.0, timeout)) as response:

MCP requests use default redirect handling, which preserves Authorization across origins. A malicious endpoint redirect can disclose the bearer token and session header.

中

scripts/tikhub_api.py:415

Python HTTP libraries

request = urllib.request.Request(

The standalone Douyin command constructs a GET from any extracted HTTP URL before checking its platform. Untrusted share text can target internal services.

中

scripts/tikhub_api.py:426

Python HTTP libraries

with urllib.request.urlopen(request, timeout=max(1.0, timeout)) as response:

The resolver follows redirects without host or private-address checks. Untrusted input or redirect destinations can cause requests to loopback or internal services.

風險因素

📁 檔案系統存取 (11)

references/api-setup.md:91 references/api-setup.md:102 references/api-setup.md:91 references/api-setup.md:102 scripts/configure_api_key.py:40 scripts/configure_api_key.py:40 scripts/configure_api_key.py:10 scripts/configure_api_key.py:61 scripts/configure_api_key.py:66 SKILL.md:107 SKILL.md:107

🔑 環境變數 (50)

⚙️ 外部命令 (31)

🌐 網路存取 (17)

scripts/extract_video_transcript.py:15 scripts/extract_video_transcript.py:146 scripts/extract_video_transcript.py:158 scripts/extract_video_transcript.py:21 scripts/extract_video.py:27 scripts/extract_video.py:28 scripts/tikhub_api.py:14 scripts/tikhub_api.py:196 scripts/tikhub_api.py:206 scripts/tikhub_api.py:282 scripts/tikhub_api.py:289 scripts/tikhub_api.py:415 scripts/tikhub_api.py:426 scripts/tikhub_api.py:19 scripts/tikhub_api.py:21 scripts/tikhub_api.py:22 scripts/tikhub_api.py:23

審計單位: codex

分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告

複製報告連結

https://skillstore.io/skills/dontbesilent2025-dbs-video-extract/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/dontbesilent2025-dbs-video-extract/security.svg)](https://skillstore.io/skills/dontbesilent2025-dbs-video-extract?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/dontbesilent2025-dbs-video-extract?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/dontbesilent2025-dbs-video-extract/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/dontbesilent2025-dbs-video-extract.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

學術引用 (APA · BibTeX · CFF)

APA 引用

dontbesilent2025. (2026). dbs-video-extract security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/dontbesilent2025-dbs-video-extract/audits/1

BibTeX 引用

@techreport{dontbesilent2025-dontbesilent2025-dbs-video-extract-2026,
  author = {dontbesilent2025},
  title = {dbs-video-extract security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/dontbesilent2025-dbs-video-extract/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "dbs-video-extract security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "dontbesilent2025"
date-released: "2026-10-17"
url: "https://skillstore.io/skills/dontbesilent2025-dbs-video-extract/audits/1"
identifiers:
  - type: other
    value: "skillstore:dontbesilent2025-dbs-video-extract:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 評分

評分依據證據置信度: 中

架構

可維護性

內容

社群

規範符合度

你可以打造什麼

Archive source material

Save spoken content and source metadata from permitted public videos into an organized Markdown research archive.

Inspect short-video performance

Retrieve available engagement statistics and author details without requesting transcription when only metadata is needed.

Review published speech

Extract a transcript from a published video for manual editorial review while retaining the original service output.

試試這些提示

Check readiness

Check which credentials are configured for dbs-video-extract. Report available capabilities without showing secrets or making network requests.

Extract one transcript

Extract only the speech transcript from [video share text]. Save it under [output directory] and report the resulting Markdown path.

Combine data and speech

Extract metadata and speech from [video share text] into [output directory]. Preserve either successful result if one service fails, and report limitations.

Control extraction and regeneration

Process [Douyin video share text] in combined mode using stdin. Prefer App data with Web fallback, retain raw metadata, and preserve existing transcripts.

最佳實務

Configure credentials through the hidden-input helper and keep keys out of chat, repositories, and logs.
Review provider charges and use only content you are authorized to process.
Pass share text through stdin, keep default HTTPS endpoints, and preserve existing transcripts unless regeneration is explicitly required.

避免

Treating credential discovery as proof of valid authentication, sufficient balance, or working provider access.
Requesting media downloads, local video rendering, or offline transcription from this extraction skill.
Using untrusted endpoint overrides or assuming arbitrary links and redirects are safe.