Social Video Downloader
Download social media videos via yt-dlp and send them to the user.
Requirements
- -
yt-dlp must be installed - INLINECODE1 recommended for best format support
Setup
See SETUP.md for installation and configuration.
Workflow
- 1. Verify download intent is clear from the user's message
- Run the download script:
python3 scripts/download.py "<url>" /tmp
- 3. On
SUCCESS:<path>, send file to user via the message tool - On
ERROR:..., report failure to user - After sending, delete the temp file with INLINECODE4
Sending the File
Use the message tool with action=send, media=<path>, and buttons=[].
If file exceeds Telegram's 50MB limit, inform the user and provide the file path instead.
Supported Platforms
Instagram (Reels, Posts), TikTok, YouTube Shorts, Twitter/X, Reddit, Facebook, Vimeo, Dailymotion, Twitch, Bilibili, and more.
Security
The script includes these protections:
- - URL allowlist — only pre-approved domains can be downloaded from
- SSRF protection — blocks URLs resolving to private/internal IP ranges
- Command injection protection — URLs are validated against shell metacharacters, and
-- separator prevents option injection - Subprocess isolation — URLs passed as separate arguments, never interpolated into shell strings
Safety Guards
- - No playlists —
--no-playlist prevents accidentally downloading hundreds of files - Metadata check — verifies video info before downloading
- Retry limit —
--retries 2 stops after failures to avoid bans - Timeout —
--socket-timeout 30 bails on stalled connections - Timestamp filenames —
social_dl_<timestamp>.mp4 prevents filename collisions
社交视频下载器
通过yt-dlp下载社交媒体视频并发送给用户。
系统要求
- - 必须安装yt-dlp
- 建议安装ffmpeg以获得最佳格式支持
安装配置
安装和配置说明请参见SETUP.md。
工作流程
- 1. 确认用户消息中明确表达了下载意图
- 运行下载脚本：
bash
python3 scripts/download.py
/tmp
- 3. 若返回SUCCESS:<路径>，通过消息工具将文件发送给用户
- 若返回ERROR:...，向用户报告失败信息
- 发送完成后，使用rm <路径>删除临时文件
文件发送
使用message工具，设置action=send、media=<路径>和buttons=[]。
若文件超过Telegram的50MB限制，请告知用户并提供文件路径。
支持平台
Instagram（Reels、帖子）、TikTok、YouTube Shorts、Twitter/X、Reddit、Facebook、Vimeo、Dailymotion、Twitch、Bilibili等。
安全机制
该脚本包含以下保护措施：
- - URL白名单 — 仅允许从预批准的域名下载
- SSRF防护 — 阻止解析到私有/内部IP范围的URL
- 命令注入防护 — 对URL进行shell元字符验证，使用--分隔符防止选项注入
- 子进程隔离 — URL作为独立参数传递，绝不插入到shell字符串中
安全防护
- - 禁止播放列表 — --no-playlist防止意外下载数百个文件
- 元数据检查 — 下载前验证视频信息
- 重试限制 — --retries 2失败后停止，避免被封禁
- 超时设置 — --socket-timeout 30在连接卡顿时自动退出
- 时间戳文件名 — socialdl<时间戳>.mp4防止文件名冲突
