热点话题追踪

Security checks across malware telemetry and agentic risk

Overview

This instruction-only skill transparently fetches public trending-topic data from a documented third-party API and does not request credentials, local files, installation, or account-changing authority.

This appears appropriate for checking public Chinese-platform trending topics. Before installing, be aware it relies on the third-party domain 60s.viki.moe for live data, and verify any returned links or claims before acting on them.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

#
ASI02: Tool Misuse and Exploitation
Low
What this means

Using the skill will contact a third-party API service, and the returned topics or links should be treated as external content.

Why it was flagged

The skill instructs the agent to make outbound HTTP API requests. This is directly aligned with fetching live trending topics and uses read-only GET endpoints.

Skill content
All endpoints use **GET** method and base URL: `https://60s.viki.moe/v2`
Recommendation

Use it for public trend lookups only, avoid sending private user data in requests, and verify returned links or claims before relying on them.

#
ASI04: Agentic Supply Chain Vulnerabilities
Low
What this means

Users have less external context for the maintainer or API service, so trust in the returned data depends on the documented third-party endpoint.

Why it was flagged

The registry metadata provides limited provenance for the skill, although the supplied package is instruction-only and does not include installable code.

Skill content
Source: unknown; Homepage: none
Recommendation

Confirm that the API domain is acceptable for your use case and treat results as untrusted public web data.