Skills conthunt

📦

conthunt

Name: conthunt
Author: synthenova

Content revision r1 Critical 🌐 Network access⚙️ External commands

Research Viral Short-Form Content with ContHunt

Finding useful short-form social content across platforms requires repeated searches and organized evidence. This skill guides ContHunt searches, analysis, boards, and research workflows.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Do not auto-install this skill.

The canonical policy requires operator review before any installation action.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "conthunt" from https://skillstore.io/skills/synthenova-conthunt.md and its manifest at https://skillstore.io/api/skills/synthenova-conthunt/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/synthenova-conthunt.md Signed manifest GET /api/skills/synthenova-conthunt/manifest Signed lockfile GET /api/skills/synthenova-conthunt/lockfile

Test it

Using "conthunt". Find recent TikTok and Reels examples about home coffee brewing.

Expected outcome:

A ranked result summary with platform, engagement context, content theme, and a saved search identifier for each result set.

Using "conthunt". Compare the videos saved on my product-launch board.

Expected outcome:

Common hooks introduce a specific problem within the opening seconds.
Demonstrations outperform static explanations across the selected items.
The board and content identifiers remain available for follow-up analysis.

Using "conthunt". Research which creator formats explain budgeting concepts clearly.

Expected outcome:

An evidence-based brief covering recurring formats, selected examples, limitations, and source identifiers for further review.

Security Audit

Critical

v1 • 9/8/2026 Open versioned report

Most alerts are false positives caused by Markdown backticks or unrelated prose. Remote installers are piped directly into shells, and the skill treats a broad use request as installation consent. SearchAgent may also initiate multiple paid searches without a stated preflight limit.

Files scanned

228

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (4)

Critical

README.md:18

Pipe to shell pattern

curl -fsSL https://conthunt.app/install.sh | sh

The documented curl command pipes an uninspected remote response directly to sh. This creates a clear arbitrary-code and supply-chain execution risk.

Critical

SKILL.md:14

Pipe to shell pattern

- macOS/Linux: `curl -fsSL https://conthunt.app/install.sh | sh`

The skill instructs the agent to pipe a remotely fetched script directly into sh. The script is neither inspected nor integrity-verified before execution.

High

SKILL.md:12-15

External Software Installation Without Explicit Confirmation

The skill treats any request to install or use ContHunt as installation authorization and directs immediate execution of remote installers.

The instruction explicitly says not to ask separately and immediately provides shell-based installers. This bypasses informed confirmation for an environment-changing action.

Medium

references/commands.md:34 SKILL.md:23

Paid Searches Lack a Preflight Limit

SearchAgent may issue multiple paid searches, but the instructions do not require cost disclosure, approval, or a user-defined spending limit before starting.

The reference explicitly states that SearchAgent can issue multiple paid searches. The operating instruction selects it by task type without requiring a spending confirmation.

Capability review items (6)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

SKILL.md:15

PowerShell invocation

- Windows PowerShell: `irm https://conthunt.app/install.ps1 | iex`

The instruction uses Invoke-RestMethod and Invoke-Expression to execute a remote response in PowerShell. This permits arbitrary code execution if delivery is compromised.

Medium

SKILL.md:14

Ruby/shell backtick execution

- macOS/Linux: `curl -fsSL https://conthunt.app/install.sh | sh`

Although the backticks are Markdown, the skill explicitly instructs the agent to execute this shell command. It runs an uninspected remote script.

Medium

SKILL.md:15

Ruby/shell backtick execution

- Windows PowerShell: `irm https://conthunt.app/install.ps1 | iex`

Although the backticks are Markdown, the enclosed PowerShell command is intended for execution. It evaluates an uninspected remote script.

Low

README.md:18

Hardcoded URL

curl -fsSL https://conthunt.app/install.sh | sh

The URL supplies a remote installation script that is immediately executed by a shell. Compromise of the endpoint or delivery path could execute arbitrary code.

Low

SKILL.md:14

Hardcoded URL

- macOS/Linux: `curl -fsSL https://conthunt.app/install.sh | sh`

The hardcoded endpoint provides executable installer content that is sent directly to sh. This network dependency can become an arbitrary-code delivery path.

Low

SKILL.md:15

Hardcoded URL

- Windows PowerShell: `irm https://conthunt.app/install.ps1 | iex`

The hardcoded endpoint provides executable installer content that is passed directly to Invoke-Expression. Endpoint compromise could deliver arbitrary code.

Risk Factors

🌐 Network access (4)

README.md:18 SKILL.md:14 SKILL.md:15 SKILL.md:43

⚙️ External commands (21)

Detected Patterns

Pipe to shell pattern×2

Audited by: codex

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/synthenova-conthunt/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/synthenova-conthunt/security.svg)](https://skillstore.io/skills/synthenova-conthunt?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/synthenova-conthunt?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/synthenova-conthunt/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/synthenova-conthunt.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

synthenova. (2026). conthunt security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/synthenova-conthunt/audits/1

BibTeX citation

@techreport{synthenova-synthenova-conthunt-2026,
  author = {synthenova},
  title = {conthunt security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/synthenova-conthunt/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "conthunt security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "synthenova"
date-released: "2026-09-08"
url: "https://skillstore.io/skills/synthenova-conthunt/audits/1"
identifiers:
  - type: other
    value: "skillstore:synthenova-conthunt:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Find Campaign References

Discover high-performing short videos in a niche and collect useful examples for campaign planning.

Compare Competitor Patterns

Search competitor topics, organize selected videos, and identify repeated formats, hooks, and audience signals.

Build Evidence-Based Briefs

Analyze relevant videos and retrieve focused evidence for editorial or creative briefs.

Try These Prompts

Run a Basic Search

Search ContHunt for [topic] on [platform]. Show the strongest results and summarize why each result is relevant.

Explore a Content Niche

Use SearchAgent to explore [niche]. Ask before paid searches, limit work to [limit], and summarize promising themes with supporting results.

Analyze a Selected Board

Create or use board [board name]. Add the selected items, run insights, and compare their hooks, formats, and audience signals.

Conduct Deep Evidence Research

Research [question] using search [search ID] or board [board ID]. Track completion, review watched items, and return evidence with source identifiers.

Best Practices

Confirm platforms, date ranges, regions, and paid-search limits before starting.
Use machine-readable output and preserve returned identifiers for follow-up commands.
Poll job status at reasonable intervals and retrieve full results only after completion.

Avoid

Do not execute remote installation scripts without inspection, verification, and explicit approval.
Do not repeat paid operations after credits are exhausted or when a start result is uncertain.
Do not expose authentication tokens, signed media URLs, or unnecessary raw payloads.