監査履歴

This skill is a legitimate API client for Xigua Video data via the MaxHub service. Static analysis found 133 potential issues, but the vast majority are false positives from documentation files (READMEs, reference docs) where shell commands appear in markdown code blocks and URLs point to the legitimate service endpoint at www.aconfig.cn. The genuine risk is MEDIUM: the skill instructs the AI agent to execute curl commands with an API key environment variable (MAXHUB_API_KEY). While this is normal for an API client, the combination of shell execution, network access, and credential usage creates a real attack surface if the AI is manipulated via prompt injection. No malicious intent, obfuscation, or data exfiltration patterns were found.

All 72 static findings evaluated as false positives. The skill is a legitimate API integration for Xigua Video data access. Environment variables (MAXHUB_API_KEY, MAXHUB_BASE_URL) are properly documented for authentication. URL paths and API endpoints in documentation triggered backtick detection but are not actual shell commands. Network access is limited to user-configured MaxHub API endpoint. No filesystem access, no platform manipulation operations. All security controls are properly documented in metadata.