Zhihu
v1.0.1Manage Zhihu AI Bot to publish, like/unlike, comment, delete comments, and fetch ring or comment details using Zhihu API credentials.
⭐ 4· 2.6k·27 current·28 all-time
byKiang@keepwonder
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md, README, and scripts/zhihu_bot.py consistently implement a Zhihu AI Bot (publish pins, like, comment, list content) and all required actions align with that purpose. However the registry-level metadata shown to you earlier lists no required env vars while the skill itself requires ZHIHU_APP_KEY and ZHIHU_APP_SECRET; this metadata mismatch is unexpected.
Instruction Scope
Runtime instructions and the CLI script limit actions to calling Zhihu's openapi (https://openapi.zhihu.com) and performing publish/like/comment/list operations. The script reads only the two credential env vars, no unrelated files or system secrets, and does not exfiltrate data to other endpoints.
Install Mechanism
There is no install spec (instruction-only skill with included Python script). That is low-risk: nothing is downloaded or executed automatically by an installer. The README suggests installing requests and using 'npx clawhub install zhihu', but there is no arbitrary remote download URL or extract step in the provided manifest.
Credentials
The skill legitimately needs two environment variables (ZHIHU_APP_KEY and ZHIHU_APP_SECRET) for HMAC authentication; this is proportionate. The concern is the inconsistency between the platform registry summary (which listed 'Required env vars: none') and the SKILL.md + code (which require the two secrets). That mismatch could be a packaging/metadata error or an omission with security implications — users must be made aware that secrets are required.
Persistence & Privilege
The skill does not request 'always: true' or other elevated persistence, and uses normal agent-invocable defaults. Autonomous invocation is allowed (platform default) but is not combined here with broad or unexpected privileges.
What to consider before installing
This skill appears to be a straightforward Zhihu API client: it uses ZHIHU_APP_KEY and ZHIHU_APP_SECRET to sign requests to https://openapi.zhihu.com and the included Python script implements the commands described. However, the registry summary you were shown does not list the required environment variables even though SKILL.md and the code do — treat that as a red flag until resolved. Before installing or enabling the skill: (1) confirm the owner/source and ask why registry metadata omits credentials; (2) store the app_secret securely (do not paste into public chat or logs); (3) run the script in a sandbox or with a non-production Zhihu account and test read-only operations first (e.g., ring detail); (4) verify network traffic (that it only contacts openapi.zhihu.com) and inspect the code locally yourself; and (5) if you allow autonomous agent invocation, consider limiting the agent's permissions or requiring manual confirmation for publish/delete actions. If the owner cannot explain the metadata mismatch, proceed cautiously or avoid granting secrets to the skill.Like a lobster shell, security has layers — review code before you run it.
latestvk977j3g024b91vtzvb63h9ky5n80qzj2
License
MIT-0
Free to use, modify, and redistribute. No attribution required.