ClawAudit verdict
douyin-posting
douyin-push-video
The skill requires storing Douyin openId and accessToken in a .env file, which could be a concern if not properly secured.
⚠ Flagged for review — coarse, uncorroborated signal, not a confirmed exploit. Review the config yourself before installing.
Automated static analysis — not a human review. ClawAudit flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.
Findings (3)
Possible hardcoded credential
scripts/get-douyin-token.js · prose · downgraded · token:', JSON.stringify(json, null, 2));
process.exit(1);
}
References tunneling service
SKILL.md · prose · downgraded · ngrok
Accesses sensitive environment variables
index.js · prose · downgraded · process.env.DOUYIN_ACCESS_TOKEN
Permissions & capabilities
No declared permissions — minimal attack surface.
Is this flag fair?
Thanks — recorded.