ClawHub
Back to skill

Security audit

Weibo, Baidu, Douyin Hot Search List - 微博百度热搜榜单

Security checks across malware telemetry and agentic risk

Overview

This skill fetches public hot-search lists from JisuAPI using a disclosed API key and shows no hidden persistence, destructive behavior, or unrelated data access.

Install this only if you are comfortable providing a JisuAPI AppKey and letting the skill contact JisuAPI when you ask for current Weibo, Baidu, or Douyin hot-search rankings. Use explicit platform names to avoid unnecessary calls.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
78% confidence
Finding
The skill metadata declares required binaries and environment variables, and the documented workflow invokes a Python script that calls an external API using an API key, but there is no explicit permission declaration for network or secret/environment access. This creates a governance gap: the runtime can access sensitive capabilities that are not transparently disclosed, making review and policy enforcement harder.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The invocation guidance uses broad natural-language triggers like '今天微博热搜前十？百度热搜有什么？或类似热搜榜单问题时', which can cause the agent to invoke the skill for loosely related prompts without clear boundaries. Over-broad activation increases the chance of unintended external API calls, unnecessary secret use, and data retrieval when a simpler non-tool response would suffice.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.