Toutiao Hot News CN | 今日头条热榜

• Risk level: Low Risk
• Analyzed: Feb 17, 2026, 7:43 AM
• Findings: 0
• Version: 1.0.0

Overview

The skill's code and runtime instructions match its stated purpose (fetching Toutiao hot-board data); it does not request credentials or external installs, though there are minor metadata/file-name inconsistencies worth checking.

This skill appears to do what it claims: fetch Toutiao's public hot-board JSON and return cleaned fields. Before installing, verify the publisher/owner (the _meta.json ownerId/slug/version differ from the registry metadata), confirm you trust that source, and correct the script filename or invocation (scripts/toutiao.cjs vs scripts/toutiao.js). Be aware the script performs outbound HTTPS requests to toutiao.com (no credentials are used), so run it where network access to that domain is acceptable and respect the site's terms of service and rate limits. If you need stronger assurance, ask the publisher for provenance or review history (Git repo) for the code.