maxhub-weibo

PassAudited by ClawScan on May 13, 2026.

Overview

This skill appears to do what it claims—query Weibo-related data through MaxHub—but it requires a MaxHub API key and sends user query parameters to aconfig.cn.

This looks suitable if you intend to use MaxHub for Weibo data collection. Before installing, make sure you trust aconfig.cn/MaxHub with your query parameters, use a controlled API key, and monitor any paid API usage.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

Anyone installing it must provide a MaxHub API key, and API calls may consume the associated account balance or quota.

Why it was flagged

The skill requires and uses a MaxHub API key for authentication to the provider API. This is expected for the stated MaxHub integration, but the key can authorize usage and potentially incur account charges.

Skill content

"authHeader": "x-api-key", "authEnvVar": "MAXHUB_API_KEY"

Recommendation

Use a dedicated MaxHub API key if possible, monitor usage/balance, and revoke or rotate the key if you stop using the skill.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Search terms, Weibo user IDs, post IDs, and similar request parameters may be visible to the MaxHub provider.

Why it was flagged

The skill clearly discloses that user query parameters are sent to the external MaxHub service. This is purpose-aligned for Weibo data retrieval, but it is still a third-party data flow users should notice.

Skill content

本Skill通过MaxHub API（aconfig.cn）获取数据，用户查询参数将发送至该服务

Recommendation

Avoid submitting private or sensitive personal information in queries, and review the provider’s privacy and billing terms before use.