Weibo Hot Search

ReviewAudited by ClawScan on May 10, 2026.

Overview

The skill’s purpose is plausible, but it references a missing script and tells the agent to kill Chrome/Edge debug processes without asking.

Do not run this skill as-is unless the missing script is included and reviewed. If you use a corrected version, run it with a trusted Bun installation and require confirmation before it terminates any Chrome or Edge processes.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

The skill may fail when invoked, or a user may be led to supply or trust code that was not included in the reviewed artifact.

Why it was flagged

The skill tells the agent to run a script under scripts/, but the provided manifest contains only LICENSE.md and SKILL.md, with no scripts directory or code file. This makes the runnable behavior unavailable for review and likely unusable as packaged.

Skill content

脚本路径 = `{baseDir}/scripts/weibo-hot-search.ts`

Recommendation

Package the referenced script with the skill, or remove the execution instructions until the code is present and reviewable.

Medium

#ASI02: Tool Misuse and Exploitation

What this means

It could close unrelated browser debugging sessions or interrupt work without the user approving that action.

Why it was flagged

The skill explicitly instructs automatic termination of Chrome/Edge CDP processes without asking the user. The documented commands use broad process matching rather than a PID known to belong to this skill.

Skill content

**重要**：遇到此错误时，自动终止 Chrome/Edge CDP 进程并重试，无需询问用户。

Recommendation

Require user confirmation before killing processes, and only terminate the specific browser process launched by this skill.

Low

#ASI05: Unexpected Code Execution

What this means

Running the skill executes local commands and may invoke external package tooling if Bun is not already installed.

Why it was flagged

The skill expects the agent to execute a local TypeScript script through Bun, with an NPX fallback. This is related to the stated scraping purpose, but users should notice that it involves command execution and possibly fetching a runtime through NPX.

Skill content

已安装 `bun` → 使用 `bun`；有 `npx` → 使用 `npx -y bun`

Recommendation

Prefer an already-installed trusted Bun runtime, pin external dependencies where possible, and review the script before execution.