V002

PassAudited by ClawScan on May 1, 2026.

Overview

The skill appears to fetch public trending lists and optionally save a report, but its package metadata and marketing claims are somewhat inconsistent.

Before installing, verify the package identity because the metadata is inconsistent, expect it to make public web/API requests to the listed platforms, and save reports only to paths you intend to overwrite. Do not rely on the advertised AI, push, scheduling, or extra-platform features unless they are added in code.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

Using the skill will contact those public services and return their hot-list data.

Why it was flagged

Running the skill performs outbound HTTP requests to third-party platforms. This is expected for a trending-list aggregator and the code does not show credential use or unrelated data transmission.

Skill content

url = 'https://api.bilibili.com/x/web-interface/popular?ps=' + str(top) ... url = 'https://www.douyin.com/aweme/v1/web/hot/search/list/' ... url = 'https://www.toutiao.com/hot-event/hot-board/?origin=toutiao_pc'

Recommendation

Install only if you are comfortable with these network requests, and review platform terms if you plan to automate or publish the data.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

The package identity may be confusing, making it harder to confirm you are installing the intended skill.

Why it was flagged

These embedded metadata values differ from the supplied registry metadata, which lists a different owner ID, slug, and version. This is a provenance/packaging inconsistency, not evidence of malicious code.

Skill content

"ownerId": "kn7dhwrh3611jhh9nac60jx2jx82h264", "slug": "daily-hot-aggregator", "version": "4.0.1"

Recommendation

Verify the ClawHub listing, homepage, slug, and version before relying on the package.

Note

ASI09: Human-Agent Trust Exploitation

What this means

Users may overestimate what the installed skill actually does.

Why it was flagged

The provided Python source implements Bilibili, Douyin, and Toutiao fetching plus a simple text summary, but does not implement the advertised extra platforms, AI summary, push channels, or scheduler.

Skill content

- 📊 **6大平台**：B站、微博、小红书、抖音、百度、知乎
- 🤖 **AI 智能摘要**：跨平台热点分析
- 📱 **多渠道推送**：Telegram/微信/邮件
- ⏰ **定时执行**：每日自动更新

Recommendation

Treat the README/package marketing claims as aspirational unless the corresponding code or configuration is added.