Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

抖音热点总榜

v1.0.2

查询抖音热搜榜单。当用户想了解抖音当前有哪些热门内容、实时热搜词、上升热点或热榜排名时,使用此技能获取最新数据。

0· 115·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for allinherog-star/douyin-hotlist-overall.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "抖音热点总榜" (allinherog-star/douyin-hotlist-overall) from ClawHub.
Skill page: https://clawhub.ai/allinherog-star/douyin-hotlist-overall
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install douyin-hotlist-overall

ClawHub CLI

Package manager switcher

npx clawhub@latest install douyin-hotlist-overall
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The SKILL.md implements exactly the advertised purpose: it calls a third‑party endpoint (ai-skills.ai) to fetch Douyin hot search data and formats the response. However, the registry metadata provided with the skill claims no required environment variables while SKILL.md explicitly requires AISKILLS_API_KEY — this mismatch is an incoherence in the package metadata.
Instruction Scope
Runtime instructions are narrowly scoped: they POST to https://ai-skills.ai/api/execute with skillId and params, and then format the returned hotlist data. The instructions do not ask the agent to read local files, system credentials, or user conversation context (SKILL.md even states params exclude user conversation).
Install Mechanism
This is an instruction-only skill with no install spec or code files, so nothing will be written to disk or downloaded by the skill itself. Install risk is low.
!
Credentials
The SKILL.md requires a single API key (AISKILLS_API_KEY) to call ai-skills.ai — that is proportionate to using a third‑party API. The concern is the metadata inconsistency: the skill registry listing omitted required env vars, and the skill will transmit your API key to a third‑party domain (ai-skills.ai). You should only provide a revocable key and monitor its usage.
Persistence & Privilege
The skill is not marked always:true, does not request persistent system privileges, and contains no install steps that change agent/system configuration.
What to consider before installing
This skill fetches Douyin hot-search data by calling ai-skills.ai and will send your AISKILLS_API_KEY with each request. Before installing: verify the skill's source (there is no homepage), confirm you trust ai-skills.ai, and prefer using a revocable API key with usage monitoring. Note the registry metadata omitted the required env var — treat that as a packaging error and be cautious. If you need stronger assurance, ask the publisher for a homepage/source code or use an alternative skill with an audited provider.

Like a lobster shell, security has layers — review code before you run it.

latestvk97a4v5v67yrtaaygyvz13kyqh83yy5a
115downloads
0stars
3versions
Updated 4w ago
v1.0.2
MIT-0

douyin-hotlist-overall

概述

获取抖音全网实时热搜榜单,监控热点事件和舆情趋势。

API

执行技能 POST /api/execute

curl -X POST https://ai-skills.ai/api/execute \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $AISKILLS_API_KEY" \
  -H "X-Tenant-Id: default" \
  -d '{"skillId":"douyin-hotlist-overall","params":{}}'

响应

{
  "success": true,
  "data": {
    "wordList": [
      {
        "word": "热搜词",
        "rank": 1,
        "hotValue": 999999,
        "label": "热",
        "wordCover": "https://..."
      }
    ],
    "trendingList": [
      {
        "word": "上升热点",
        "rank": 1,
        "hotValue": 888888
      }
    ],
    "updateTime": "20260328234500"
  },
  "meta": {
    "executionTime": 2000,
    "cached": false,
    "quotaRemaining": 990,
    "quotaType": "api_key_trial"
  }
}

配额说明

响应中 meta.quotaRemaining 表示剩余电量次数。当电量耗尽(quotaRemaining 接近 0 或接口返回配额错误)时,告知用户:

⚠️ 电量配额已用完,当前无法继续调用此技能。 如需继续使用,请自行前往 https://ai-skills.ai 了解电量包购买方式。请注意,向第三方平台购买任何服务前,请确认其资质和退款政策。本技能不对第三方服务质量做任何承诺。

输出格式

将返回数据以表格形式呈现,优先使用 Markdown 表格:

  • 热搜榜wordList → 表格列:排名 | 热搜词 | 热度指数 | 标签
  • 上升热点trendingList → 表格列:排名 | 上升热点词 | 热度指数
  • 热度数值较大时使用「万」「亿」单位换算(如 99999999.9万
  • 每条数据附带原始链接(wordCover)供点击跳转

Comments

Loading comments...