maxhub-xiaohongshu

AdvisoryAudited by Static analysis on May 13, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

The skill can use the configured MaxHub account and may incur usage charges or expose queries to that provider.

Why it was flagged

The skill authenticates to the MaxHub provider using the user's MAXHUB_API_KEY, which is expected for the stated API service but is still a sensitive credential.

Skill content

"apiBase": { "url": "https://www.aconfig.cn", "authHeader": "x-api-key", "authEnvVar": "MAXHUB_API_KEY" }

Recommendation

Use a dedicated or scoped MaxHub API key if available, monitor usage and balance, and revoke the key if you stop using the skill.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

Complex requests may trigger multiple API calls, increasing cost and sending more query context to the provider.

Why it was flagged

The skill can chain multiple provider API calls for complex requests; the artifact discloses this and says explicit user confirmation is required.

Skill content

链式调用：复杂需求可串联多个API完成（需用户明确确认后执行）

Recommendation

Review and confirm multi-step or batch requests, especially if they involve many notes, users, comments, or pages.