Threads社媒数据采集

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:58 AM UTC
• Version: 3.6.1

Overview

This Threads API skill is mostly a data-query helper, but it needs review because its activation and platform scope are broader than its stated Threads-only purpose.

Review before installing. Use it only for intended Threads lookups, avoid submitting sensitive/private content as search terms or URLs, verify the MaxHub provider and API key handling, and prefer a pinned or otherwise trusted ClawHub installer command. The unrelated Douyin/Xiaohongshu references should be removed or split into separate platform-specific skills before broad use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:16

Finding

Unpinned Package Execution in Installation Instructions

Content

View full analysis

Vulnerability Details

File Location: README.md, line 16
Vulnerability Type: Supply-chain risk caused by executing an unpinned package
Risk Level: Medium

Vulnerable Code

bash

npx clawhub install maxhub-threads

Technical Analysis

The documented installation command invokes clawhub through npx without specifying a package version or integrity constraint. If the package is not already available locally, npx may retrieve and execute the package version currently published by the configured registry.

Consequently, the code executed during installation is mutable and is not necessarily the same code that existed when this Skill was audited. Compromise of the package publisher, registry account, package release process, or transitive dependency chain could turn the installation command into a code-execution vector.

The same command is duplicated in README_CN.md at line 16. That duplicate does not create an independent vulnerability and is covered by this finding.

Attack Path

1. An attacker compromises the clawhub package, its publisher account, release pipeline, registry distribution path, or a dependency executed by the package.
2. The attacker publishes a malicious version under the expected package name.
3. A user follows the installation documentation and runs npx clawhub install maxhub-threads.
4. npx resolves and retrieves the mutable package version from the configured registry.
5. The malicious package executes with the operating-system privileges of the user running the command.

This is a supply-chain attack path; the audited repository itself does not contain evidence of an active malicious package or embedded payload.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the installing user's account. The resulting scope could include access to files, environment variables, credentials, network resources, and configuration available to that account. Additional sy ...[truncated 129 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the installer to a specifically reviewed version, for example:

   bash

   npx clawhub@<reviewed-version> install maxhub-threads
   

2. Publish and verify package integrity information or signatures before execution.

3. Document the expected package registry and discourage installation from untrusted registry mirrors.

4. Prefer a previously installed and independently verified CLI over implicit download-and-execute behavior.

5. Use lockfiles or equivalent dependency controls wherever the installation workflow supports them.

6. Apply the same hardened command to both README.md and README_CN.md.

7. Advise users not to run the installation command with administrative privileges unless strictly required.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md

| 禁止行为 | 正确做法 |
|----------|----------|
| ❌ 自行拼接路径（如 `/api/v1/douyin/search/xxx`） | ✅ 使用 Action Table 或 `<!-- Full path: -->` 中的路径 |
| ❌ 猜测参数名（如把 `aweme_id` 写成 `video_id`） | ✅ 使用 Action Table 或 reference 文件中的参数名 |
| ❌ 假设 v1/v2/v3 参数兼容 | ✅ 降级时重新读取对应版本的参数文档 |
| ❌ 调用 `fetch_hot_search_list` 或 `app/v3/fetch_video_comments` | ✅ 使用替代端点（见废弃标注） |

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md

| 禁止行为 | 正确做法 |
|----------|----------|
| ❌ 自行拼接路径(如 `/api/v1/douyin/search/xxx`) | ✅ 使用 Action Table 或 `<!-- Full path: -->` 中的路径 |
| ❌ 猜测参数名(如把 `aweme_id` 写成 `video_id`) | ✅ 使用 Action Table 或 reference 文件中的参数名 |
| ❌ 假设 v1/v2/v3 参数兼容 | ✅ 降级时重新读取对应版本的参数文档 |
| ❌ 调用 `fetch_hot_search_list` 或 `app/v3/fetch_video_comments` | ✅ 使用替代端点(见废弃标注) |

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.

md

| "analyze" / "分析一下" | Switch to analyze mode |
| "compare with X" / "和X对比" | Add X as second query |

## Output Guidelines

1. **Language consistency** — ALL output matches user's detected language.
2. **Markdown links** — All URLs in `[text](url)` format.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill is ներկայացված as a Threads-only assistant, but its fallback/error-handling sections include concrete Douyin and Xiaohongshu endpoints. This scope mismatch can misroute requests to unrelated platforms, causing unintended third-party data access and undermining operator trust about what systems the skill can reach.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post-user.md (reported line 11)May include surrounding context.

md

`GET /api/v1/threads/web/fetch_post_detail`

<!-- Full path: /api/v1/threads/web/fetch_post_detail -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post-user.md (reported line 45)May include surrounding context.

md

`GET /api/v1/threads/web/fetch_post_detail_v2`

<!-- Full path: /api/v1/threads/web/fetch_post_detail_v2 -->

### Parameters

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The install instruction uses npx clawhub without pinning an exact version, which can cause users to execute whatever package version is current at install time. If the upstream package is compromised, typosquatted, or a malicious update is published, this README directly encourages arbitrary code execution on user systems.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README lists invocation examples as generic single words like "帖子, 用户" and "搜索, 搜", which are common everyday terms and do not clearly define when the skill should activate versus not activate. The description provides no narrowing constraints, explicit trigger list, or negative examples to prevent unintended invocation collisions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The README instructs users to run npx clawhub install maxhub-threads without pinning a specific package version. This creates a supply-chain risk because the latest published package or its transient dependencies could change over time, allowing a compromised or malicious release to be executed during installation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The example trigger words are extremely broad (帖子，用户, 搜索，搜), which can easily collide with normal conversation in Chinese. In an agent or skill-routing environment, this raises the chance of unintended invocation, causing the skill to process user input or make external queries when the user did not explicitly intend to activate it.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file instructs the assistant to maintain the detected language throughout the conversation and later states that all output must match the user's detected language. This forces a language/locale decision based on detection rather than explicit user preference, which can violate language-choice policy if detection is wrong or the user wants another language.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The skill sends user queries and the bearer-authenticated request to an external third-party API service. External transmission is expected for an API-backed skill, but it still creates privacy and governance risk because user-supplied content and account-linked access are transferred off-system.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md

maxhub_auth_header="Authorization: Bearer ${MAXHUB_API_KEY}"

# GET example
curl -s "https://www.aconfig.cn/api/v1/threads/{endpoint}?{params}" \
  -H "$maxhub_auth_header"

# POST example

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The compliance declaration asserts that all endpoints are legitimate, read-only, and aligned to the skill purpose, but later content contradicts that claim by documenting unrelated platform endpoints. Such misleading safety framing can suppress scrutiny and cause users or orchestrators to trust broader access than intended.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill routes on generic words like "search", "find", "show me", "analyze", and "compare", and also says to default to "Post & User" when uncertain. These broad natural-language triggers can match many ordinary requests, increasing the chance of unintended invocation or misrouting without clear negative examples or scope constraints.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 71% confidence

Finding

The file presents core instructions and parameter descriptions in a mixed Chinese/English format, but it does not state whether users may choose their preferred language or whether the bilingual format is required for a specific audience. Per SQP-3, forcing or implicitly assuming a language/locale without opt-in can be a policy issue unless the constraint is documented and justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file documents external API usage against https://www.aconfig.cn and includes endpoints that send user-provided values such as post URLs and search queries, but it does not include any user-facing warning about sharing that data with a third-party service. Under the markdown-specific SQP-2 criteria, descriptions should warn about behaviors that may affect user privacy or data handling.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The document consistently mixes English and Chinese labels and descriptions, such as the bilingual title and parameter descriptions. Because there is no indication that the skill is region-specific or that users can choose their preferred language, this may violate a language/locale policy requiring user opt-in or justified locale constraints.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.