Skills Explorer Add Skills

douban-skill

An agent skill by daymade, from daymade/claude-code-skills. Tags: api, data, export, spreadsheets, sync.

What it does

Export and sync Douban (豆瓣) book/movie/music/game collections to local CSV files via Frodo API. Supports full export (all history) and RSS incremental sync (recent items). Use when the user wants to export Douban reading/watching/listening/gaming history, back up their Douban data, set up incremental sync, or mentions 豆瓣/douban collections. Triggers on: 豆瓣, douban, 读书记录, 观影记录, 书影音, 导出豆瓣.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add daymade/claude-code-skills --skill douban-skill

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/daymade/claude-code-skills
cp -r claude-code-skills/douban-skill ~/.claude/skills/douban-skill

Safety box score

Grade B, low risk: 23 of 100 risk points, rated 2026-10-19. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill runs a Python Frodo API exporter and an optional Node RSS sync script to pull a user’s Douban collection history and write CSVs locally. The main risks are outbound network access to Douban and automatic writes/overwrites under the user’s Downloads folder; it does not request sudo or use the user’s personal login cookies.

Category levels, from 0 (none) to 3 (high)
CategoryLevelWhy
Code & shell execution2 (moderate)It ships runnable scripts with shebangs and explicit invocation paths, e.g. `python3 scripts/douban-frodo-export.py` and `node scripts/douban-rss-sync.mjs`, so installing it grants code execution of the bundled exporter/sync logic.
Network access2 (moderate)Both scripts make outbound HTTPS requests to Douban endpoints (`https://frodo.douban.com` and `https://www.douban.com/feed/people/${DOUBAN_USER}/interests`), so the skill sends the user ID and collection queries off-machine.
Filesystem reach1 (low)It writes output under `~/Downloads/douban-sync/<user_id>/` (or `DOUBAN_OUTPUT_DIR`) and the RSS sync persists `.douban-rss-state.json`; writes are bounded but outside the repo and can overwrite existing CSVs.
Secrets & credentials1 (low)The code embeds credential-like values (`API_KEY = '0dad551ec0f84ed02907ff5c42e8ec70'`, `HMAC_SECRET = b'bf7dddc7c9cfe6f7'`), though the docs state these are public Douban mobile app credentials rather than user secrets.
Privilege & persistence0 (none)No sudo, service registration, global installs, shell startup edits, or OS-wide settings changes appear in the skill files.
Instruction hijack surface0 (none)I found no prompt-injection or instruction-hijacking content such as requests to ignore safeguards, fetch remote instructions, or hide actions.
Irreversible actions0 (none)The skill only exports/syncs when explicitly run; it does not post, publish, pay, book, deploy, or delete anything outside local file creation.
Transparency0 (none)All shipped files are plain text and readable; there are no binaries, minified blobs, or runtime-downloaded installers.

Before installing

Rated 2026-10-19 by an automated review of 5 files from the skill's repository.

Source

Repository
daymade/claude-code-skills (all skills from this repository)
Path
douban-skill/SKILL.md
Branch
main
Updated
2026-09-20