maxhub-kuaishou
PassAudited by ClawScan on May 13, 2026.
Overview
This appears to be a coherent Kuaishou data-query skill that uses a MaxHub API key to call the declared aconfig.cn service; users should review API-key, cost, and query-privacy implications.
Install only if you are comfortable sending Kuaishou query parameters to MaxHub/aconfig.cn and using a MAXHUB_API_KEY that may incur charges. For large searches or analysis chains, request a call-count/cost estimate first. This review is based on the provided artifacts; several manifest-listed files were omitted from the prompt, so verify the published package/source if you need higher assurance.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Using the skill can consume the user's MaxHub API quota or balance under the configured API key.
The skill reads MAXHUB_API_KEY from the environment and uses it as the x-api-key header for provider requests. This is expected for the declared MaxHub API integration, but it grants access to the user's MaxHub account/quota.
const AUTH_HEADER = config.apiBase.authHeader; ... [AUTH_HEADER]: resolveCredential()
Use a dedicated MaxHub key if possible, keep it only in the environment/config store, monitor balance and usage, and revoke the key if you stop using the skill.
A broad analysis request may result in multiple API calls and potential charges.
The skill supports chained and bulk API calls, which can multiply requests and cost. The documentation also describes confirmation and count warnings, so this is purpose-aligned rather than suspicious.
链式调用：复杂需求可串联多个API完成（需用户明确确认后执行） ... 批量操作（>10条）前会提示预计调用次数
For bulk or chained analysis, ask for the estimated number of calls/cost first and only approve the scope you actually need.
Search keywords, Kuaishou links, video IDs, user IDs, or similar parameters you provide may be sent to a third-party API provider.
The skill discloses that user query parameters are sent to the MaxHub/aconfig.cn provider. This is necessary for the integration, but users should understand the data boundary.
本Skill通过MaxHub API（aconfig.cn）获取数据，用户查询参数将发送至该服务
Do not submit sensitive private information as query input, and review the provider's privacy and retention practices if that matters for your use case.
Recent query results may remain in the skill's process memory briefly, but the reviewed code does not show disk persistence.
The optimization layer keeps recent GET responses in an in-memory cache for a short TTL. This is bounded and purpose-aligned for reducing duplicate paid calls.
cache: { maxSize: 50, defaultTTL: 3 * 60 * 1000 }Avoid sensitive query terms and restart/clear the session if you need to ensure recent cached results are gone.