{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "douyin-downloader",
  "built": "2026-10-26",
  "control_level": 5,
  "control_level_label": "L5 严管",
  "capabilities": [
    "reverse_api",
    "terms_compliance",
    "execute_command",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "isolated_environment",
      "per_use_authorization"
    ],
    "admin": [
      "strict_authorization",
      "full_audit",
      "compliance_signoff"
    ]
  },
  "evidence": [
    {
      "file": "SKILL.md / 脚本",
      "summary": "Calls undocumented or reverse-engineered private APIs / spoofs client identity"
    },
    {
      "file": "SKILL.md / 脚本参数",
      "summary": "Bypasses automated detection, disables host sandboxing, or skips SSL certificate verification"
    },
    {
      "file": "scripts/",
      "summary": "Executes local script or command: douyin.js (runs under node, single-file CLI)"
    },
    {
      "file": "网络端点",
      "summary": "Declares external network access: https://www.douyin.com/aweme/v1/web/aweme/detail/?aweme_id=… (undocumented web endpoint)"
    },
    {
      "file": "本地工作目录",
      "summary": "File read/write and artifact output: {outputDir}/{video_id}.mp4 (downloaded video)"
    }
  ],
  "verification": {
    "method": "第二遍独立重读 + 反查：① 清单核对：bundle §1 仅 3 个文件（SKILL.md/_meta.json/douyin.js），逐个读完，确认无隐藏脚本与混淆；② 端点重扫：§3 URL 命中与 douyin.js 内常量对照，外发收敛为 douyin.com、v.douyin.com、api.siliconflow.cn；③ 凭据面穷举：核对 process.env.DOUYIN_API_KEY/API_KEY 与 Authorization 头构造，确认仅用于转写；④ 反查“是否更严重”：§3「危險旗標/防護繞過」与「沙箱/未受控執行」均无命中，未见 eval/远程代码/批量循环；⑤ 功能声明核对：描述的三项（无水印链接/下载视频/提取文案）在脚本中均有对应实现。",
    "second_pass": [
      {
        "item": "调用未公开 web 端点（red 主因之一）",
        "status": "ok",
        "detail": "douyin.js 拼接 https://www.douyin.com/aweme/v1/web/aweme/detail/?aweme_id=… 自行实现请求，非官方开放 API。"
      },
      {
        "item": "移动端 UA 冒充（red 主因之二）",
        "status": "ok",
        "detail": "HEADERS 固定 iPhone Safari UA（EdgiOS/121.0）并用于所有请求；属客户端冒充。"
      },
      {
        "item": "去水印串替换",
        "status": "ok",
        "detail": "videoUrl 由 play_addr 的 url_list 经 replace('playwm', 'play') 得到，兑现「无水印」卖点。"
      },
      {
        "item": "外部进程与音频出网",
        "status": "ok",
        "detail": "spawn(ffmpeg/ffprobe) 用于转音频与探测；转写 POST 到 api.siliconflow.cn 并带 Bearer ApiKey，属素材出网。"
      },
      {
        "item": "无 TLS 降级 / 无高级伪装 / 无任意代码执行",
        "status": "ok",
        "detail": "§3 危险旗标与沙箱两类均无命中；无 eval/动态加载远程模块；无批量采集。"
      },
      {
        "item": "来源与元数据",
        "status": "ok",
        "detail": "_meta.json 记 owner whille、slug douyin-downloader-nodejs、version 1.0.0、publishedAt 1771744202949；SKILL.md homepage 指向 github.com/yzfly/douyin-mcp-server。"
      }
    ],
    "level": 2,
    "level_label": "V2 已复核",
    "commit": "dd0bf355955b4c82b764740b4183c86a72ba0e0c",
    "sha256": "46c40531df5008076133ad413bd4595542149e96bcb45d6af721e8b5b0245e81",
    "reviewed_by": "skills-bayx-audit",
    "reviewed_at": "2026-10-25"
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-10-10/douyin-downloader.tar.gz",
    "sha256": "46c40531df5008076133ad413bd4595542149e96bcb45d6af721e8b5b0245e81",
    "commit": "dd0bf355955b4c82b764740b4183c86a72ba0e0c"
  },
  "original": {
    "github": "https://github.com/freestylefly/canghe-skills/tree/main/skills/canghe-douyin-downloader",
    "path": "skills/canghe-douyin-downloader",
    "commit": "dd0bf355955b4c82b764740b4183c86a72ba0e0c"
  }
}