Home / All Skills / Content & Media Creation / douyin-downloader
English (EN)简体中文 (ZH)日本語 (JA)
Content & Media Creation · freestylefly/canghe-skills

douyin-downloader

Douyin watermark-free video downloader and transcript extraction tool

L5 Restricted · Isolated sandbox & strict auditV2 Human-AuditedReverse APITerms / ComplianceExecute CommandNetwork AccessWrite FileDual-pass Audit
Author freestyleflyGitHub freestylefly/canghe-skills ↗License MIT（仓库根 LICENSE）Commit dd0bf35595
Control levels describe skill capabilities and suggested control measures; they do not represent quality or safety certifications, nor do they dictate usability. Usage decisions rest entirely with users and administrators. Different agent hosts apply varying constraints; do not assume hosts provide automatic protection. Third-party skill copyrights belong to their original authors. Use at your own risk.

1How It Works & Mechanism

This is a single-file Node CLI directly invoked via exec/command line as douyin.js, with three subcommands info/download/extract handling distinct tasks.

skills/canghe-douyin-downloader/SKILL.md
node /root/.openclaw/workspace/skills/douyin-downloader/douyin.js info "抖音分享链接"
What it is doing: SKILL.md declares invocation via OpenClaw's exec tool; the script itself parses commands along with -o/-v/--save-video parameters using process.argv.

Parsing share links: extracts the URL via regex, follows redirects for short links (v.douyin.com), extracts the numerical video ID, and requests the Douyin web detail endpoint.

skills/canghe-douyin-downloader/douyin.js
const apiUrl = `https://www.douyin.com/aweme/v1/web/aweme/detail/?aweme_id=${awemeId}`;
What it is doing: This is an internal implementation calling an undocumented web endpoint outside the official API, which is why it can retrieve video information without an API key.

Fetching the "watermark-free" download URL: prioritizes play_addr and replaces playwm with play in the URL (string replacement for watermark removal), otherwise falling back to download_addr.

skills/canghe-douyin-downloader/douyin.js
const videoUrl = videoData.video?.play_addr?.url_list?.[0]?.replace('playwm', 'play') ||
What it is doing: Uses string substitution to obtain the watermark-free direct URL, which is the underlying mechanism for the "watermark-free" feature described.

Uniformly masquerades requests as iPhone Safari: all http/https requests include a hardcoded mobile User-Agent header to spoof a mobile browser.

skills/canghe-douyin-downloader/douyin.js
'User-Agent': 'Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) EdgiOS/121.0.2277.107 Version/17.0 Mobile/15E148 Safari/604.1'
What it is doing: Relies on this mobile UA spoofing for all API requests and page scraping, constituting client impersonation behavior.

Streaming video downloads to disk: retrieves response streams via https/http requests, logs progress based on content-length, pipes data to a local file, and follows 3xx redirects.

skills/canghe-douyin-downloader/douyin.js
const writer = fs.createWriteStream(filepath);
What it is doing: downloadFile handles recursive redirects, progress reporting, and error handling, ultimately saving the file to disk as {video_id}.mp4.

Extracting audio via an external ffmpeg subprocess: converts mp4 to mp3 using -vn + libmp3lame, placing the audio path adjacent to the video file.

skills/canghe-douyin-downloader/douyin.js
const proc = spawn(ffmpegPath, args);
What it is doing: runFfmpeg wraps spawn and throws an error on non-zero exit codes; the skill frontmatter also declares requires bins: [ffmpeg].

Speech-to-text uploads audio to the third-party "SiliconFlow" service: sends a POST multipart request to a fixed endpoint, passing the user's API Key as a Bearer token.

skills/canghe-douyin-downloader/douyin.js
const DEFAULT_API_BASE_URL = 'https://api.siliconflow.cn/v1/audio/transcriptions';
What it is doing: This represents an outbound path transmitting user content (audio) to an external service backend, implementing the described "transcript extraction (API key required)".

Saves transcript to markdown and cleans up intermediate artifacts: writes transcript.md (including video ID/extraction time/download link and body text), deleting temporary mp4 and mp3 files if saving the video was not enabled.

skills/canghe-douyin-downloader/douyin.js
fs.writeFileSync(outputPath, markdown, 'utf-8');
What it is doing: Outputs to {outputDir}/{video_id}/transcript.md; clean-up is handled via fs.unlinkSync(videoPath) and unlinkSync(audioPath).

Reads API Key from environment variables: checks DOUYIN_API_KEY or API_KEY; if missing, extract throws an error and exits immediately.

skills/canghe-douyin-downloader/douyin.js
apiKey = process.env.DOUYIN_API_KEY || process.env.API_KEY;
What it is doing: Reads user credentials solely for its declared feature (speech-to-text); info/download do not require a key.

Falls back to page parsing if the API fails: scrapes the window._ROUTER_DATA JSON embedded in the douyin.com page to extract video metadata.

skills/canghe-douyin-downloader/douyin.js
const match = pageContent.match(/window\._ROUTER_DATA\s*=\s*(.*?)<\/script>/);
What it is doing: Tries the detail endpoint first and falls back to scraping embedded page JSON upon failure, making it more resilient to endpoint changes.

2Core Capabilities

01Fetch watermark-free video info and direct download URLs (info subcommand)
02Download Douyin videos locally (download subcommand)
03Speech-to-text transcript extraction (extract subcommand, requires API key)
04Audio extraction (ffmpeg conversion to mp3)
05Media metadata probing (ffprobe reads duration/size)
06Short link redirect resolution and fallback to page JSON
07API Key environment variable configuration (DOUYIN_API_KEY / API_KEY)
08Download progress display and temporary file cleanup

3External Dependencies

KindDependency / Endpoint
networkwww.douyin.com（未公开的 aweme detail web 端点）
networkv.douyin.com（分享短链，先跟重定向取真实 URL）
api硅基流动 语音转写 API（上传音频，Bearer DOUYIN_API_KEY）
cliffmpeg（转音频）与 ffprobe（读媒体信息）

4Recommended Governance & Evidence

Suggested Controls for Safe Operation
For Agent Runtime
Isolated environment, per-use explicit authorization
For Administrators
Strict authorization, full audit, compliance signoff
Evidence & Triggers (File Paths & Excerpts)
  • SKILL.md / 脚本: Calls undocumented or reverse-engineered private APIs / spoofs client identity
  • SKILL.md / 脚本参数: Bypasses automated detection, disables host sandboxing, or skips SSL certificate verification
  • scripts/: Executes local script or command: douyin.js (runs under node, single-file CLI)
  • 网络端点: Declares external network access: https://www.douyin.com/aweme/v1/web/aweme/detail/?aweme_id=… (undocumented web endpoint)
  • 本地工作目录: File read/write and artifact output: {outputDir}/{video_id}.mp4 (downloaded video)
Audit Notes: (Capability/policy-level assessment, not malicious code). (a) Reverse engineering / impersonation: The script independently calls Douyin's undocumented web endpoint https://www.douyin.com/aweme/v1/web/aweme/detail/, hardcodes an iPhone Safari User-Agent across all requests to spoof a mobile client, and replaces playwm with play in play_addr to obtain direct watermark-free links (bypassing platform watermarking). (b) Outbound data transmission: extract uploads extracted audio from user videos to the third-party backend api.siliconflow.cn (Bearer DOUYIN_API_KEY), sending user media to an external service. (c) Command surface: spawns external ffmpeg/ffprobe subprocesses. Severity justification: No TLS downgrade detected, no advanced anti-automation evasion (no webdriver patching or signature forgery), no arbitrary code execution, and no bulk scraping; while orange factors (reading env credentials + outbound media) are present, red criteria (reverse engineering undocumented endpoints + mobile client spoofing + watermark removal replacement) are established, leading to the stricter red rating.

5Second-Pass Verification

  • [ok] 调用未公开 web 端点（red 主因之一） — douyin.js 拼接 https://www.douyin.com/aweme/v1/web/aweme/detail/?aweme_id=… 自行实现请求，非官方开放 API。
  • [ok] 移动端 UA 冒充（red 主因之二） — HEADERS 固定 iPhone Safari UA（EdgiOS/121.0）并用于所有请求；属客户端冒充。
  • [ok] 去水印串替换 — videoUrl 由 play_addr 的 url_list 经 replace('playwm', 'play') 得到，兑现「无水印」卖点。
  • [ok] 外部进程与音频出网 — spawn(ffmpeg/ffprobe) 用于转音频与探测；转写 POST 到 api.siliconflow.cn 并带 Bearer ApiKey，属素材出网。
  • [ok] 无 TLS 降级 / 无高级伪装 / 无任意代码执行 — §3 危险旗标与沙箱两类均无命中；无 eval/动态加载远程模块；无批量采集。
  • [ok] 来源与元数据 — _meta.json 记 owner whille、slug douyin-downloader-nodejs、version 1.0.0、publishedAt 1771744202949；SKILL.md homepage 指向 github.com/yzfly/douyin-mcp-server。

6Verdict & Scenarios

  • Zero-dependency single file: runs with just Node and ffmpeg, requires no npm install, ready for drop-in use.
  • Credential-free for info/download: retrieves watermark-free links and downloads videos without providing any key.
  • Chains download -> audio extraction -> transcription -> markdown generation into a complete pipeline with a single command (covering common watermark removal and transcription needs).
  • Fallback mechanism for URL extraction: falls back to parsing embedded window._ROUTER_DATA on page when the API fails, ensuring resilience against interface changes.
  • Cleans up intermediate artifacts: deletes temporary mp4 and mp3 files when saving the video is not explicitly enabled, minimizing leftover files.
    • Best for: Suitable for individuals looking to quickly save Douyin share links as watermark-free videos or transcribe spoken content into text notes (provided they have ffmpeg and a SiliconFlow API key, and accept stability and compliance risks).
    Not for: Not suitable for scenarios requiring stable SLAs, copyright compliance audits, or bulk scraping; not suitable for users sensitive to outbound data transfer (uploading to third-party transcription); not suitable for environments without ffmpeg installed or unfamiliar with Node.
    Install Agent-Ready
    ① Verified Mirror 2026-10-10
    Option A · Direct DownloadDownload douyin-downloader.tar.gz
    sha256: 46c40531df500807…
    Option B · Copy Guide for Agent
    install.json
    Agents automatically download and verify mirrors from this JSON guide.
    ② Upstream GitHub
    GitHub Repo ↗
    Pinned to commit dd0bf35595.