Content & Media Creation · dontbesilent2025/dbskill

dbs-video-extract

Name: dbs-video-extract
Author: dontbesilent2025/dbskill

Accepts short video links or shared text from Douyin, Xiaohongshu, WeChat Channels, etc., queries post/account metrics, extracts speech transcripts, and archives them as Markdown organized by author and title. Intended for users who want to fully parse short videos to obtain metrics or transcripts; runs a preflight check for TikHub and Qingdou credentials beforehand and guides beginners through purchasing and secure configuration if keys are missing.

L5 Restricted · Isolated sandbox & strict auditV2 Human-AuditedCredential / SessionExecute CommandNetwork AccessWrite FileDual-pass Audit

Author dontbesilent2025GitHub dontbesilent2025/dbskill ↗Stars 10121License CC BY-NC 4.0（非商业授权）：仓库根 LICENSE 为 Attribution-NonCommercial 4.0 International (CC BY-NC 4.0)，Copyright (c) 2026 dontbesilent；GitHub API license.spdx_id = NOASSERTION （CC BY-NC 4.0 非 SPDX 标准文本，GitHub 无法自动识别），不得用于商业用途Commit 8b8e33f1ec

Control levels describe skill capabilities and suggested control measures; they do not represent quality or safety certifications, nor do they dictate usability. Usage decisions rest entirely with users and administrators. Different agent hosts apply varying constraints; do not assume hosts provide automatic protection. Third-party skill copyrights belong to their original authors. Use at your own risk.

1How It Works & Mechanism

Runs a read-only credential precheck before any extraction action, narrowing capabilities down to whichever side is currently available via credential_state.

skills/dbs-video-extract/SKILL.md

python3 scripts/extract_video.py --check-keys

Four states: complete / data_only / transcript_only / unavailable; SKILL.md specifies that execution can proceed if only one key is present, but it must clearly communicate which subset of tasks can be handled.

Maintains a clear division of labor between two external services: TikHub handles structured post/account metrics, while Qingdou handles voice transcripts, with hardcoded platform support scopes.

skills/dbs-video-extract/SKILL.md

- 当前 TikHub 专用数据解析支持抖音、小红书和微信视频号；其他轻抖可识别的平台仍可只执行文字稿提取。

The Data Boundaries section of SKILL.md also specifies: Douyin prioritizes App V3 and falls back to Web only once if no valid data is found; Xiaohongshu uses App V2 video note details; Channels uses Channels V2 post details.

TikHub operations use MCP (Streamable HTTP), with protocol versions and endpoints for the three platforms hardcoded as script constants.

skills/dbs-video-extract/scripts/tikhub_api.py

MCP_PROTOCOL_VERSION = "2024-11-05"

MCP_URLS maps douyin/xiaohongshu/wechat to their respective mcp.tikhub.io paths; REST defaults to https://api.tikhub.dev.

Qingdou operations follow a REST workflow of 'submit task + poll for results', with built-in timeout and interval controls.

skills/dbs-video-extract/scripts/extract_video_transcript.py

url = f"{base_url.rstrip('/')}/web/api/getTaskResult?{query}"

After submission via commit_task, poll_task polls batchStatus (0/1 processing, 2 finished); the timeout is governed by --transcript-timeout (default 900s).

Keys are resolved via a four-tier fallback order: environment variables → user-specified local file → ~/.config/dbs/API_Keys.md → macOS Keychain.

skills/dbs-video-extract/scripts/extract_video_transcript.py

["security", "find-generic-password", "-s", KEYCHAIN_SERVICE, "-w"],

Keychain service names are dbs-tikhub-api-key / dbs-qingdou-api-key; attempted only on darwin when DBS_VIDEO_EXTRACT_DISABLE_KEYCHAIN=1 is not set.

The bundled secure configuration script uses getpass for hidden input, writes to a file with 0600 permissions, and performs atomic replacement so keys never appear in commands, responses, or logs.

skills/dbs-video-extract/scripts/configure_api_key.py

secret = getpass.getpass("使用凭证：").strip()

Disk-write sequence: tempfile.mkstemp temporary file → chmod 0600 → os.replace atomic replacement → target file chmod 0600 again; the temporary file is deleted on failure.

Request failure messages replace API keys with [REDACTED] before throwing errors to prevent credentials from leaking into responses via error messages.

skills/dbs-video-extract/scripts/tikhub_api.py

detail = detail.replace(api_key, "[REDACTED]")

The Qingdou script handles this identically (using the same replacement pattern in extract_video_transcript.py).

Performs shape validation on the Base URL and API paths (permitting only pure HTTPS domains + a fixed /api/v1/ prefix) to minimize the attack surface of redirected destinations.

skills/dbs-video-extract/scripts/tikhub_api.py

raise TikHubError("Base URL 必须是只有域名的 HTTPS 地址。")

normalize_api_path also rejects paths containing domain names, query strings, or fragments; these are strictly anti-misconfiguration measures, not anti-scraping bypasses.

Archiving rules and user edit protection: writes to {output_dir}/{author}/{title}.md, skips existing files by default, and only overwrites when --overwrite is set.

skills/dbs-video-extract/scripts/extract_video_transcript.py

path.write_text(render_markdown(item, title, author), encoding="utf-8")

SKILL.md explicitly states: 'Default to skipping transcript writes if the same source already exists, preserving user edits'.

When credentials are missing, avoids throwing technical jargon and instead follows a smooth path: 'Explain API Key → Select Capabilities → Purchase Guidance → Mandatory Legal Notice → Local Secure Configuration'.

skills/dbs-video-extract/SKILL.md

> dbskill 是免费开源项目，与 TikHub、轻抖无隶属、合作或利益关系。充值由用户自主决定，相关交易、服务、争议及风险由用户自行承担；法律另有规定的除外，dbskill 不承担责任。

Legal notices must be displayed verbatim without omission or rephrasing; purchase links come from code constant PURCHASE_URLS and only show currently missing services.

Preserves partial results on single-sided failures: if either side fails, the other side still completes, and partial_success is marked in the JSON summary.

skills/dbs-video-extract/SKILL.md

TikHub 或轻抖任一侧失败时继续完成另一侧，并在汇总中标记 `partial_success`。已经取得的结果不能因单侧失败而丢弃。

Credential status, TikHub data summaries, and transcript paths are output within the same JSON summary to facilitate higher-level agent decision-making.

2Core Capabilities

01URL extraction and platform identification from copied share text (Douyin/Xiaohongshu/Channels)

02TikHub MCP data queries (posts/accounts), including --raw-data raw responses

03Qingdou transcript submission and polling, faithfully preserving body text without rewriting

04Markdown archiving organized by author/title, skipping existing files by default (protecting user edits)

05Tiered credential states (complete/data_only/transcript_only/unavailable) with single-sided graceful degradation

06Multi-source credential resolution (env / specified file / ~/.config/dbs/API_Keys.md / macOS Keychain)

07Secure configuration script (hidden input + 0600 permissions + atomic writes)

08Billing and legal transparency: notifies about potential billing prior to execution; enforces verbatim disclaimer display on purchase guidance

09Partial success fault tolerance and non-destructive outputs (no automatic downloading of media/publishing/Git commits)

3External Dependencies

Kind	Dependency / Endpoint
api	TikHub（作品/账号数据，MCP Streamable HTTP + REST）
api	轻抖（语音文字稿提交与轮询）
cli	python3（运行 4 个自带脚本；仅标准库）
cli	security（macOS 钥匙串读取，仅 darwin 且未禁用时）
network	购买/充值页（仅展示给用户人工操作，不由脚本访问）

4Recommended Governance & Evidence

Suggested Controls for Safe Operation

For Agent Runtime

Isolated environment, per-use explicit authorization

For Administrators

Strict authorization, full audit, compliance signoff

Evidence & Triggers (File Paths & Excerpts)

本地凭据 / 浏览器配置: Reads user login cookies/sessions/keyrings: macOS Keychain services dbs-tikhub-api-key / dbs-qingdou-api-key (security find-generic-
scripts/: Executes local scripts or commands: python3 scripts/extract_video.py --check-keys / --mode both|data|transcript
网络端点: Declares external network access: TikHub: https://api.tikhub.dev / https://api.tikhub.io (REST)
本地工作目录: File I/O and artifact generation: {output_dir}/{author}/{title}.md (transcript archiving; skips existing files by default, overwrites only with --overwrite)

Audit Notes: Grading basis is fully derived from verifiable code inside this skill repository: the 4 included Python scripts 'read credentials/private tokens for self-declared purposes'—find_api_key sequentially reads env TIKHUB_API_KEY/QINGDOU_API_KEY, TIKHUB_API_KEYS_FILE/QINGDOU_API_KEYS_FILE, ~/.config/dbs/API_Keys.md, and macOS Keychain dbs-tikhub-api-key/dbs-qingdou-api-key; user links and text are sent to third-party backends TikHub (mcp.tikhub.io / api.tikhub.dev) and Qingdou (www.qingdou.vip), which may incur billing and transmit assets externally, while writing Markdown to user-specified directories. Matching Batch 4 precedents (home-assistant reading $HASS_TOKEN, ai-image-generation/ai-video-generation backends = orange), this is rated 🟠. It does not trigger red criteria: no API reverse engineering, no client impersonation, no TLS/sandbox downgrading, no platform restriction bypassing, and no arbitrary code execution.

5Second-Pass Verification

[ok] 凭证四级来源与钥匙串调用真实存在 — tikhub_api.py / extract_video_transcript.py 中 find_api_key 依次读 env → 指定文件 → ~/.config/dbs/API_Keys.md → subprocess security；KEYCHAIN_SERVICE 分别为 dbs-tikhub-api-key、dbs-qingdou-api-key。
[ok] 凭证写入按安全实践（0600 + 原子替换） — configure_api_key.py：mkstemp → write → temporary.chmod(0o600) → os.replace → target.chmod(0o600)，异常时 unlink 临时文件。
[ok] 错误信息脱敏（不泄漏 Key） — 两个客户端均含 detail.replace(api_key, "[REDACTED]")，且响应体截断（500/1000 字符）。
[ok] 外部端點清单无遗漏 — 全量 URL 抽取得到的运行时端點仅 TikHub（REST/MCP）与轻抖；其余为文档/购买页链接。
[ok] 无第三方 Python 包依赖 — 脚本 import 仅 json/logging/os/re/subprocess/sys/time/urllib/datetime/pathlib/typing/argparse/tempfile/getpass；目录内无 requirements.txt/setup.py/pyproject.toml。
[ok] 不绕过平台限制、不自动下载/发布 — SKILL.md 原文"公开、删除、私密、版权和可见范围限制以接口返回为准，不尝试绕过。"与"不自动下载媒体、发布内容、提交 Git 或推送。"
[ok] "已存在默认跳过"的写盘保护属实 — extract_video_transcript.py save_item 依据 overwrite 参数决定是否跳过；SKILL.md 与 agents/openai.yaml 表述一致。
[ok] 付费与法律提示为强制展示 — SKILL.md"必须先原样展示下面这条提示，不能省略或改写"，法律提示文本与脚本 LEGAL_NOTICE 常量同源。

6Verdict & Scenarios

Treats 'missing credentials' as a first-class citizen: read-only precheck first, narrows down capabilities across four states next, and only then provides purchase and configuration guidance, cleanly stopping when keys are absent.

Thorough credential hygiene: hidden input via getpass, 0600 file permissions, atomic file replacement, [REDACTED] in error messages, multi-source resolution, and strict prohibitions against logging keys or passing them as command-line arguments.

Preserves results on failure: completes the unaffected side and marks partial_success if one side fails; falls back from Douyin App to Web only once.

Zero third-party dependencies using solely standard libraries to minimize supply chain attack surfaces; hardcodes endpoints and protocol versions as constants for easy auditing.

Transparent delivery: reports credential status, tools used, fallback triggers, key metrics, transcript paths, and billing status, while concealing internal identifiers such as batchId.

Best for: Ideal for content creators and researchers who need to batch extract metrics and voice transcripts from Douyin, Xiaohongshu, and WeChat Channels share links and archive them into searchable Markdown organized by author and title; also suited for users holding only one TikHub or Qingdou credential who want to operate in a degraded mode matching their available capabilities.

Not for: Not suitable for users without any credentials who are unwilling to purchase external services (the skill explicitly states that if neither service is enabled, it cannot be used, and it will not bypass restrictions); not suitable for downloading video/image media files (explicitly does not automatically download media); not suitable for restricted content (private/deleted/copyright-restricted statuses follow API responses and are not bypassed); not suitable for workflows involving pasting keys directly into chat dialogs (the skill requires using the local configuration script).

Install Agent-Ready

① Verified Mirror 2026-09-15

Option A · Direct DownloadDownload dbs-video-extract.tar.gz

sha256: 3d8bb7e6cc40716a…

Option B · Copy Guide for Agent

install.json

Agents automatically download and verify mirrors from this JSON guide.

② Upstream GitHub

GitHub Repo ↗

Pinned to commit 8b8e33f1ec.