Skill Trust Decision

link-resolver-engine

Name: link-resolver-engine Trust Review Report
Item: link-resolver-engine
Rating: 80
Author: ClawSafe

合法的 Bilibili/抖音视频下载工具，包含未声明的 Playwright/Chromium 安装行为和 ffmpeg 自动下载，属于中等供应链风险，但未发现恶意行为。

Install decision first Source: ClawHub Scanned: Jul 3, 2026

Files 10

Artifacts 25

Violations 2

Findings 5

Why this conclusion was reached

2/4 dimensions flagged

Block

Declared vs actual capability

2 undeclared or violating capabilities were inferred.

Block

Hidden execution and egress

3 high-risk artifacts or egress signals were extracted.

Pass

Attack chain and severe findings

There is no explicit malicious chain in the report.

Review

Dependencies and supply chain hygiene

6 dependency or supply-chain issues need attention.

What drove the risk score up

未声明的 Chromium 运行时下载 +10

bilibili_video.py:56 和 douyin_video.py:42 均调用 subprocess 安装 playwright chromium，SKILL.md 仅声明 python 二进制

未声明的 ffmpeg 自动下载 +5

video_snapper.py 通过 ffmpeg-downloader 从 gyan.dev/johnvansickle/evermeet.cx 下载二进制，未在文档中声明

pip 依赖无版本锁定 +5

ensure_package.py 安装 requests、playwright、yt-dlp 等均使用通配符版本

Most important evidence

Medium Supply Chain

未声明的 Playwright/Chromium 运行时安装

bilibili_video.py 和 douyin_video.py 在导入时均调用 subprocess.check_call 安装 playwright chromium，SKILL.md 仅声明 python 依赖，未提及浏览器内核下载。Chromium 二进制约 100-300MB，从 Google 官方 CDN 下载，存在供应链劫持风险。

scripts/bilibili_video.py:56

在 SKILL.md metadata.bins 中声明 chromium，或预先安装后通过环境变量跳过自动下载

Medium Supply Chain

未声明的 ffmpeg 自动下载

video_snapper.py 调用 ffmpeg-downloader 从 gyan.dev（Windows）、johnvansickle（Linux）、evermeet.cx（macOS）下载约 100MB 便携版 ffmpeg，SKILL.md 未声明此依赖。

scripts/video_snapper.py:46

在文档中声明 ffmpeg 依赖，或要求宿主环境预装

Low Supply Chain

pip 依赖无版本锁定

ensure_package.py 对 requests、playwright、yt-dlp、tf-playwright-stealth 等包使用无版本约束的 pip install，可能安装到存在已知漏洞的版本。

scripts/ensure_package.py:1

为关键依赖指定版本范围，如 requests>=2.31.0

Low Doc Mismatch

硬编码占位 IP 地址

预扫描发现 bilibili_video.py:131/278 和 douyin_video.py:85 存在硬编码占位 IP（120.0.0.0、125.0.0.0、134.0.0.0），经审查这些 IP 均未被用于实际网络请求，可能是开发期占位符代码。

scripts/bilibili_video.py:131

清理代码中的占位 IP 注释

Info Supply Chain

fix_setuptools_for_legacy_packages 强制重装打包工具

ensure_package.py:27 强制降级重装 packaging、setuptools、wheel，可能影响系统其他 Python 工具的稳定性。

scripts/ensure_package.py:27

使用虚拟环境隔离或移除该强制重装逻辑

Declared capability vs actual capability

Network Pass

Declared READ

→

Inferred READ

bilibili_video.py:102-179 bilibili API 请求; douyin_video.py:77-142 douyin API/页面请求

Filesystem Pass

Declared WRITE

→

Inferred WRITE

bilibili_video.py:220-260 写入 downloads 目录; douyin_video.py:157 写入文件

Shell Block

Declared NONE

→

Inferred WRITE

bilibili_video.py:56 subprocess 安装 chromium; douyin_video.py:42 同; video_snapper.py:46 subprocess ffmpeg-downloader

Browser Block

Declared NONE

→

Inferred WRITE

douyin_video.py:71-142 使用 playwright.chromium 无头浏览器

Suspicious artifacts and egress

High IP Address

120.0.0.0

scripts/bilibili_video.py:131

High IP Address

125.0.0.0

scripts/bilibili_video.py:278

High IP Address

134.0.0.0

scripts/douyin_video.py:85

Medium External URL

https://api.bilibili.com/x/web-interface/nav

scripts/bilibili_video.py:102

Medium External URL

https://www.bilibili.com/

scripts/bilibili_video.py:132

Medium External URL

https://www.bilibili.com

scripts/bilibili_video.py:133

Medium External URL

https://api.bilibili.com/x/web-interface/view?bvid=

scripts/bilibili_video.py:144

Medium External URL

https://api.bilibili.com/x/player/wbi/playurl

scripts/bilibili_video.py:177

Medium External URL

https://www.bilibili.com/video/BV1GYXKBzEvM/

scripts/bilibili_video.py:479

Medium External URL

https://www.douyin.com/video/

scripts/douyin_video.py:77

Medium External URL

https://www.douyin.com/

scripts/douyin_video.py:138

Medium External URL

https://v.douyin.com/ezOqxZPY3kc/

scripts/douyin_video.py:224

Dependencies and supply chain

Package	Version	Source	Known vuln	Notes
playwright	`*`	pip	No	无版本锁定；安装时自动下载 chromium（约 100-300MB）
tf-playwright-stealth	`*`	pip	No	无版本锁定
yt-dlp	`*`	pip	No	无版本锁定
requests	`*`	pip	No	无版本锁定
pydub	`*`	pip	No	无版本锁定
ffmpeg-downloader	`*`	pip	No	无版本锁定；运行时从 gyan.dev/johnvansickle/evermeet.cx 下载 ffmpeg 二进制

File composition

10 files · 1950 lines

Python 7 files · 1766 linesMarkdown 2 files · 144 linesIgnore 1 files · 40 lines

Files of concern · 5

scripts/bilibili_video.py Python · 517 lines

未声明的 Playwright/Chromium 运行时安装 · 硬编码占位 IP 地址 · 120.0.0.0 · 125.0.0.0 · https://api.bilibili.com/x/web-interface/nav · https://www.bilibili.com/ · https://www.bilibili.com · https://api.bilibili.com/x/web-interface/view?bvid= · https://api.bilibili.com/x/player/wbi/playurl · https://www.bilibili.com/video/BV1GYXKBzEvM/

scripts/douyin_video.py Python · 311 lines

134.0.0.0 · https://www.douyin.com/video/ · https://www.douyin.com/ · https://v.douyin.com/ezOqxZPY3kc/ · https://m.douyin.com/share/video/ · https://aweme\.snssdk\.com/aweme/v1/playwm/\?[^ · https://aweme.snssdk.com链接中找 · https://aweme\.snssdk\.com[^\s

scripts/video_snapper.py Python · 299 lines

未声明的 ffmpeg 自动下载 · https://www.bilibili.com/video/BV1xx... · https://bilibili.com/video/BV1xx... · https://www.bilibili.com/video/av123... · https://b23.tv/xxxx

scripts/ensure_package.py Python · 297 lines

pip 依赖无版本锁定 · fix_setuptools_for_legacy_packages 强制重装打包工具 · https://...、本地.zip · https://pypi.tuna · https://pypi.tuna.tsinghua.edu.cn/simple

scripts/env_manager.py Python · 235 lines

https://download.pytorch.org/whl/cpu · https://download.pytorch.org/whl/

Other files · README.md · SKILL.md · logger_manager.py · config.py · .gitignore

Security positives

代码逻辑清晰，B站/抖音视频解析为真实工具需求

WBI 签名算法、Bilibili API 调用为标准合法实现

Playwright stealth 插件是公开反爬手段，非恶意

未发现凭证收割、reverse shell、数据外泄等恶意行为

未访问 ~/.ssh、~/.aws、.env 等敏感路径

所有外部网络请求均指向目标平台合法 API