maxhub-zhihu
PassAudited by ClawScan on May 13, 2026.
Overview
This appears to be a legitimate Zhihu/MaxHub API skill, but it requires a MaxHub API key and sends your Zhihu query parameters to aconfig.cn.
Before installing, make sure you trust aconfig.cn/MaxHub with your Zhihu search parameters and API key. Use a dedicated API key, watch for paid API usage, and do not enter sensitive personal information into queries. Some manifest-listed files were not included in the supplied text, so this review has medium—not high—confidence.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Your MaxHub API key will be used to make requests to the MaxHub provider and may incur account usage or cost.
The skill reads MAXHUB_API_KEY from the environment and sends it as the configured API authentication header.
const AUTH_HEADER = config.apiBase.authHeader; const AUTH_ENV_NAME = config.apiBase.authEnvVar; ... [AUTH_HEADER]: resolveCredential()
Use a dedicated MaxHub API key if possible, keep it secret, monitor account usage, and revoke it if you uninstall or stop using the skill.
Search terms, Zhihu IDs, and similar query parameters are sent to aconfig.cn to retrieve results.
The skill is designed to call an external provider API for Zhihu data using user-supplied query parameters.
"apiBase": { "url": "https://www.aconfig.cn", "authHeader": "x-api-key", "authEnvVar": "MAXHUB_API_KEY", "prefix": "/api/v1/zhihu" }Only use the skill if you trust the MaxHub/aconfig.cn provider, and avoid submitting private or sensitive information as search parameters.
Recent query parameters and API results may remain in memory during the session to reduce repeated calls.
The skill caches API responses and cache keys derived from request parameters in process memory for a limited time.
this.cache = new Map(); ... return `${path}?${sortedParams}`; ... this.cache.set(key, { data, expireAt: Date.now() + (ttl || this.defaultTTL) })Avoid sensitive queries and restart/clear the runtime if you need to ensure cached results are gone.