๐ฆ
maxhub-toutiao
81Query Toutiao Content Data
Toutiao research often requires separate lookups for articles, videos, users, and comments. This skill routes those requests through MaxHub and returns concise bilingual results.
Productivity View
Skills maxhub-skills
๐ฆ
maxhub-skills
v3.2.0 Content revision r1 Critical ๐ Network access๐ Env variablesโ๏ธ External commands
Query Social Media Data with MaxHub
Teams need structured social media data without hand-building API calls. This skill guides Claude, Codex, and Claude Code through MaxHub API lookups across supported platforms.
Supports: Claude Codex Code(CC)
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "maxhub-skills" from https://skillstore.io/skills/xiewxx-maxhub-skills.md and its manifest at https://skillstore.io/api/skills/xiewxx-maxhub-skills/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "maxhub-skills". Analyze a TikTok creator profile and recent videos.
Expected outcome:
A concise profile summary, recent content themes, engagement observations, comment signals, and clear notes on unavailable fields.
Using "maxhub-skills". Find WeChat articles for a keyword.
Expected outcome:
A ranked list of relevant articles with titles, sources, dates, short summaries, and suggested follow-up checks.
Using "maxhub-skills". Compare Lemon8 and TikTok results for a product topic.
Expected outcome:
A side-by-side comparison of result types, visible engagement signals, creator overlap, and data limitations.
Security Audit
Criticalv4 โข 7/8/2026 Open versioned report
Most static command, network, blocker, and obfuscation matches are documentation false positives. I confirmed credential handling risk for MAXHUB_API_KEY and added semantic findings for TikTok security bypass helpers, metric manipulation, user-cookie forwarding, and a security pre-approval claim. The skill should not be published until those high-risk capabilities and claims are removed or isolated.
33
Files scanned
13,250
Lines analyzed
67
Review items
0
False positives ignored
Confirmed security concerns (4)
Critical
maxhub-tiktok/SKILL.md:127-133maxhub-tiktok/references/api-video.md:7-35maxhub-tiktok/references/api-video.md:3916-4118
Platform Security Bypass Helpers Exposed
The TikTok routes include helpers for request signatures, encryption, fingerprints, msToken values, device registration, and guest cookies. These capabilities can support bypassing platform anti-automation controls.
The endpoint names and descriptions directly reference signatures, encryption, fingerprints, msToken generation, and device registration. This is strong semantic evidence of platform security bypass tooling.
Critical
Metric Manipulation Endpoint Exposed
The TikTok API reference documents a function that increases a video play count and returns a success status. This is a platform manipulation capability, not a read-only data query.
The cited description says the endpoint increases a work video play count and reports success or failure. That directly supports business-logic abuse and contradicts read-only positioning.
High
maxhub-tiktok/SKILL.md:66-78maxhub-tiktok/references/api-user.md:96-114maxhub-tiktok/references/api-user.md:161-181
User Cookie Forwarding to Third Party
Several TikTok endpoints accept or require user cookies for account-specific data. Forwarding browser cookies to MaxHub can expose account sessions and private user data.
The documentation explicitly warns that some endpoints require platform session cookies and shows cookie parameters. Cookies can authorize account access beyond simple public data retrieval.
High
Prompt Injection Attempt Detected
RECOMMENDATION.md claims the skill has passed ClawHub security review. Security pre-approval claims can bias automated review and must not be treated as authoritative.
The file contains a direct security-approval claim in marketplace-facing prose. It does not issue an explicit override command, so confidence is high but not maximal.
Capability review items (67)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Generic API/secret keys
2. ้
็ฝฎ:`openclaw config set skills.entries.maxhub-lemon8.apiKey "<ไฝ ็-key>"` ๆ `export MAXHUB_API_KEY=
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
2. Configure: `openclaw config set skills.entries.maxhub-lemon8.apiKey "<your-key>"` or `export MAXH
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
Auth: `Authorization: Bearer $MAXHUB_API_KEY`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
Auth: `Authorization: Bearer $MAXHUB_API_KEY`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
primaryEnv: MAXHUB_API_KEY
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
- MAXHUB_API_KEY
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
- name: MAXHUB_API_KEY
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
Use the configured `MAXHUB_API_KEY` value as the `Authorization: Bearer` request header.
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
maxhub_auth_header="Authorization: Bearer ${MAXHUB_API_KEY}"
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
[ -n "${MAXHUB_API_KEY:-}" ] && echo "ok" || echo "missing"
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
> - OpenClaw/ClawHub:`openclaw config set skills.entries.maxhub-lemon8.apiKey "ไฝ ็_API_KEY"`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
> - ้็จ็ฏๅขๅ้:`export MAXHUB_API_KEY="ไฝ ็_API_KEY"`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
> - OpenClaw/ClawHub: `openclaw config set skills.entries.maxhub-lemon8.apiKey "YOUR_API_KEY"`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
> - Generic: `export MAXHUB_API_KEY="YOUR_API_KEY"`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
2. ้
็ฝฎ:`openclaw config set skills.entries.maxhub-tiktok.apiKey "<ไฝ ็-key>"` ๆ `export MAXHUB_API_KEY=
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
2. Configure: `openclaw config set skills.entries.maxhub-tiktok.apiKey "<your-key>"` or `export MAXH
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
Auth: `Authorization: Bearer $MAXHUB_API_KEY`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
Auth: `Authorization: Bearer $MAXHUB_API_KEY`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
Auth: `Authorization: Bearer $MAXHUB_API_KEY`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
Auth: `Authorization: Bearer $MAXHUB_API_KEY`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
primaryEnv: MAXHUB_API_KEY
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
- MAXHUB_API_KEY
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
- name: MAXHUB_API_KEY
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
Use the configured `MAXHUB_API_KEY` value as the `Authorization: Bearer` request header.
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
maxhub_auth_header="Authorization: Bearer ${MAXHUB_API_KEY}"
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
[ -n "${MAXHUB_API_KEY:-}" ] && echo "ok" || echo "missing"
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
> - OpenClaw/ClawHub:`openclaw config set skills.entries.maxhub-tiktok.apiKey "ไฝ ็_API_KEY"`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
> - ้็จ็ฏๅขๅ้:`export MAXHUB_API_KEY="ไฝ ็_API_KEY"`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
> - OpenClaw/ClawHub: `openclaw config set skills.entries.maxhub-tiktok.apiKey "YOUR_API_KEY"`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
> - Generic: `export MAXHUB_API_KEY="YOUR_API_KEY"`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
2. ้
็ฝฎ:`openclaw config set skills.entries.maxhub-toutiao.apiKey "<ไฝ ็-key>"` ๆ `export MAXHUB_API_KEY
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
2. Configure: `openclaw config set skills.entries.maxhub-toutiao.apiKey "<your-key>"` or `export MAX
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
Auth: `Authorization: Bearer $MAXHUB_API_KEY`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
primaryEnv: MAXHUB_API_KEY
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
- MAXHUB_API_KEY
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
- name: MAXHUB_API_KEY
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
Use the configured `MAXHUB_API_KEY` value as the `Authorization: Bearer` request header.
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
maxhub_auth_header="Authorization: Bearer ${MAXHUB_API_KEY}"
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
[ -n "${MAXHUB_API_KEY:-}" ] && echo "ok" || echo "missing"
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
> - OpenClaw/ClawHub:`openclaw config set skills.entries.maxhub-toutiao.apiKey "ไฝ ็_API_KEY"`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
> - ้็จ็ฏๅขๅ้:`export MAXHUB_API_KEY="ไฝ ็_API_KEY"`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
> - OpenClaw/ClawHub: `openclaw config set skills.entries.maxhub-toutiao.apiKey "YOUR_API_KEY"`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
> - Generic: `export MAXHUB_API_KEY="YOUR_API_KEY"`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
2. ้
็ฝฎ:`openclaw config set skills.entries.maxhub-wechat.apiKey "<ไฝ ็-key>"` ๆ `export MAXHUB_API_KEY=
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
2. Configure: `openclaw config set skills.entries.maxhub-wechat.apiKey "<your-key>"` or `export MAXH
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
Auth: `Authorization: Bearer $MAXHUB_API_KEY`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
Auth: `Authorization: Bearer $MAXHUB_API_KEY`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
primaryEnv: MAXHUB_API_KEY
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
- MAXHUB_API_KEY
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
- name: MAXHUB_API_KEY
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
Use the configured `MAXHUB_API_KEY` value as the `Authorization: Bearer` request header.
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
maxhub_auth_header="Authorization: Bearer ${MAXHUB_API_KEY}"
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
[ -n "${MAXHUB_API_KEY:-}" ] && echo "ok" || echo "missing"
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
> - OpenClaw/ClawHub:`openclaw config set skills.entries.maxhub-wechat.apiKey "ไฝ ็_API_KEY"`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
> - ้็จ็ฏๅขๅ้:`export MAXHUB_API_KEY="ไฝ ็_API_KEY"`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
> - OpenClaw/ClawHub: `openclaw config set skills.entries.maxhub-wechat.apiKey "YOUR_API_KEY"`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
> - Generic: `export MAXHUB_API_KEY="YOUR_API_KEY"`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
export MAXHUB_API_KEY=mh_sk_your_api_key_here
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
export MAXHUB_API_KEY=mh_sk_your_api_key_here
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
export MAXHUB_API_KEY=mh_sk_your_api_key_here
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
primaryEnv: MAXHUB_API_KEY
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
- MAXHUB_API_KEY
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
- name: MAXHUB_API_KEY
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
ๆๆๆ่ฝ็ปไธ้่ฟ `MAXHUB_API_KEY` ่ฎค่ฏ,Base URL ไธบ `https://www.aconfig.cn`ใ
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
MAXHUB_API_KEY="your_api_key_here"
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
maxhub_auth_header="Authorization: Bearer ${MAXHUB_API_KEY}"
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
High
Generic API/secret keys
- **frontmatter.metadata.openclaw.primaryEnv**:็ปไธไธบ `MAXHUB_API_KEY`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
Risk Factors
๐ Network access (106)
maxhub-lemon8/_meta.json:6 maxhub-lemon8/_meta.json:7 maxhub-lemon8/SKILL.md:18 maxhub-lemon8/SKILL.md:22 maxhub-lemon8/SKILL.md:30 maxhub-lemon8/SKILL.md:32 maxhub-lemon8/SKILL.md:45 maxhub-lemon8/SKILL.md:53 maxhub-lemon8/SKILL.md:57 maxhub-lemon8/SKILL.md:77 maxhub-lemon8/SKILL.md:88 maxhub-tiktok/_meta.json:6 maxhub-tiktok/_meta.json:7 maxhub-tiktok/references/api-ads-analytics.md:660 maxhub-tiktok/references/api-ads-analytics.md:662 maxhub-tiktok/references/api-ads-analytics.md:663 maxhub-tiktok/references/api-ads-analytics.md:664 maxhub-tiktok/references/api-ads-analytics.md:665 maxhub-tiktok/references/api-search.md:564 maxhub-tiktok/references/api-search.md:574 maxhub-tiktok/references/api-search.md:666 maxhub-tiktok/references/api-search.md:670 maxhub-tiktok/references/api-search.md:671 maxhub-tiktok/references/api-search.md:675 maxhub-tiktok/references/api-search.md:676 maxhub-tiktok/references/api-user.md:57 maxhub-tiktok/references/api-user.md:479 maxhub-tiktok/references/api-user.md:482 maxhub-tiktok/references/api-user.md:483 maxhub-tiktok/references/api-user.md:487 maxhub-tiktok/references/api-user.md:488 maxhub-tiktok/references/api-user.md:495 maxhub-tiktok/references/api-user.md:496 maxhub-tiktok/references/api-video.md:4305 maxhub-tiktok/references/api-video.md:4326 maxhub-tiktok/references/api-video.md:4328 maxhub-tiktok/references/api-video.md:4517 maxhub-tiktok/references/api-video.md:4521 maxhub-tiktok/references/api-video.md:4522 maxhub-tiktok/references/api-video.md:4526 maxhub-tiktok/references/api-video.md:4527 maxhub-tiktok/references/api-video.md:4665 maxhub-tiktok/references/api-video.md:4669 maxhub-tiktok/references/api-video.md:4970 maxhub-tiktok/references/api-video.md:4974 maxhub-tiktok/references/api-video.md:4980 maxhub-tiktok/references/api-video.md:4984 maxhub-tiktok/references/api-video.md:5319 maxhub-tiktok/references/api-video.md:5321 maxhub-tiktok/references/api-video.md:5322 maxhub-tiktok/references/api-video.md:5323 maxhub-tiktok/references/api-video.md:5324 maxhub-tiktok/references/api-video.md:5431 maxhub-tiktok/references/api-video.md:5437 maxhub-tiktok/references/api-video.md:5541 maxhub-tiktok/references/api-video.md:5542 maxhub-tiktok/references/api-video.md:5658 maxhub-tiktok/references/api-video.md:5662 maxhub-tiktok/references/api-video.md:5663 maxhub-tiktok/references/api-video.md:5672 maxhub-tiktok/references/api-video.md:5740 maxhub-tiktok/references/api-video.md:5742 maxhub-tiktok/references/api-video.md:5747 maxhub-tiktok/references/api-video.md:5749 maxhub-tiktok/SKILL.md:18 maxhub-tiktok/SKILL.md:22 maxhub-tiktok/SKILL.md:30 maxhub-tiktok/SKILL.md:32 maxhub-tiktok/SKILL.md:45 maxhub-tiktok/SKILL.md:53 maxhub-tiktok/SKILL.md:57 maxhub-tiktok/SKILL.md:75 maxhub-tiktok/SKILL.md:77 maxhub-tiktok/SKILL.md:98 maxhub-tiktok/SKILL.md:109 maxhub-toutiao/_meta.json:6 maxhub-toutiao/_meta.json:7 maxhub-toutiao/SKILL.md:18 maxhub-toutiao/SKILL.md:22 maxhub-toutiao/SKILL.md:30 maxhub-toutiao/SKILL.md:32 maxhub-toutiao/SKILL.md:45 maxhub-toutiao/SKILL.md:53 maxhub-toutiao/SKILL.md:57 maxhub-toutiao/SKILL.md:77 maxhub-toutiao/SKILL.md:88 maxhub-wechat/_meta.json:6 maxhub-wechat/_meta.json:7 maxhub-wechat/SKILL.md:18 maxhub-wechat/SKILL.md:22 maxhub-wechat/SKILL.md:30 maxhub-wechat/SKILL.md:32 maxhub-wechat/SKILL.md:45 maxhub-wechat/SKILL.md:53 maxhub-wechat/SKILL.md:57 maxhub-wechat/SKILL.md:77 maxhub-wechat/SKILL.md:88 README.md:47 README.md:196 RECOMMENDATION.md:151 SKILL.md:18 SKILL.md:22 SKILL.md:30 SKILL.md:34 SKILL.md:149 SKILL.md:153
๐ Env variables (67)
maxhub-lemon8/README_CN.md:22 maxhub-lemon8/README.md:22 maxhub-lemon8/references/api-post-user.md:4 maxhub-lemon8/references/api-search-discover.md:4 maxhub-lemon8/SKILL.md:10 maxhub-lemon8/SKILL.md:13 maxhub-lemon8/SKILL.md:17 maxhub-lemon8/SKILL.md:47 maxhub-lemon8/SKILL.md:50 maxhub-lemon8/SKILL.md:68 maxhub-lemon8/SKILL.md:80 maxhub-lemon8/SKILL.md:81 maxhub-lemon8/SKILL.md:91 maxhub-lemon8/SKILL.md:92 maxhub-tiktok/README_CN.md:26 maxhub-tiktok/README.md:26 maxhub-tiktok/references/api-ads-analytics.md:4 maxhub-tiktok/references/api-search.md:4 maxhub-tiktok/references/api-user.md:4 maxhub-tiktok/references/api-video.md:4 maxhub-tiktok/SKILL.md:10 maxhub-tiktok/SKILL.md:13 maxhub-tiktok/SKILL.md:17 maxhub-tiktok/SKILL.md:47 maxhub-tiktok/SKILL.md:50 maxhub-tiktok/SKILL.md:89 maxhub-tiktok/SKILL.md:101 maxhub-tiktok/SKILL.md:102 maxhub-tiktok/SKILL.md:112 maxhub-tiktok/SKILL.md:113 maxhub-toutiao/README_CN.md:20 maxhub-toutiao/README.md:20 maxhub-toutiao/references/api-content-user.md:4 maxhub-toutiao/SKILL.md:10 maxhub-toutiao/SKILL.md:13 maxhub-toutiao/SKILL.md:17 maxhub-toutiao/SKILL.md:47 maxhub-toutiao/SKILL.md:50 maxhub-toutiao/SKILL.md:68 maxhub-toutiao/SKILL.md:80 maxhub-toutiao/SKILL.md:81 maxhub-toutiao/SKILL.md:91 maxhub-toutiao/SKILL.md:92 maxhub-wechat/README_CN.md:21 maxhub-wechat/README.md:21 maxhub-wechat/references/api-channels.md:4 maxhub-wechat/references/api-mp.md:4 maxhub-wechat/SKILL.md:10 maxhub-wechat/SKILL.md:13 maxhub-wechat/SKILL.md:17 maxhub-wechat/SKILL.md:47 maxhub-wechat/SKILL.md:50 maxhub-wechat/SKILL.md:68 maxhub-wechat/SKILL.md:80 maxhub-wechat/SKILL.md:81 maxhub-wechat/SKILL.md:91 maxhub-wechat/SKILL.md:92 README.md:46 README.md:195 RECOMMENDATION.md:150 SKILL.md:10 SKILL.md:13 SKILL.md:17 SKILL.md:34 SKILL.md:146 SKILL.md:147 SKILL.md:199
โ๏ธ External commands (107)
maxhub-lemon8/SKILL.md:45 maxhub-lemon8/SKILL.md:47 maxhub-lemon8/SKILL.md:49-61 maxhub-lemon8/SKILL.md:61-67 maxhub-lemon8/SKILL.md:67-69 maxhub-lemon8/SKILL.md:69-80 maxhub-lemon8/SKILL.md:80-81 maxhub-lemon8/SKILL.md:81-91 maxhub-lemon8/SKILL.md:91-92 maxhub-lemon8/SKILL.md:92-106 maxhub-lemon8/SKILL.md:106-107 maxhub-lemon8/SKILL.md:107-108 maxhub-lemon8/SKILL.md:108-160 maxhub-tiktok/SKILL.md:45 maxhub-tiktok/SKILL.md:47 maxhub-tiktok/SKILL.md:49-61 maxhub-tiktok/SKILL.md:61-75 maxhub-tiktok/SKILL.md:75-77 maxhub-tiktok/SKILL.md:77-88 maxhub-tiktok/SKILL.md:88-90 maxhub-tiktok/SKILL.md:90-101 maxhub-tiktok/SKILL.md:101-102 maxhub-tiktok/SKILL.md:102-112 maxhub-tiktok/SKILL.md:112-113 maxhub-tiktok/SKILL.md:113-127 maxhub-tiktok/SKILL.md:127-128 maxhub-tiktok/SKILL.md:128-129 maxhub-tiktok/SKILL.md:129-130 maxhub-tiktok/SKILL.md:130-131 maxhub-tiktok/SKILL.md:131-132 maxhub-tiktok/SKILL.md:132-133 maxhub-tiktok/SKILL.md:133-192 maxhub-toutiao/SKILL.md:45 maxhub-toutiao/SKILL.md:47 maxhub-toutiao/SKILL.md:49-61 maxhub-toutiao/SKILL.md:61-67 maxhub-toutiao/SKILL.md:67-69 maxhub-toutiao/SKILL.md:69-80 maxhub-toutiao/SKILL.md:80-81 maxhub-toutiao/SKILL.md:81-91 maxhub-toutiao/SKILL.md:91-92 maxhub-toutiao/SKILL.md:92-106 maxhub-toutiao/SKILL.md:106-154 maxhub-wechat/SKILL.md:45 maxhub-wechat/SKILL.md:47 maxhub-wechat/SKILL.md:49-61 maxhub-wechat/SKILL.md:61-67 maxhub-wechat/SKILL.md:67-69 maxhub-wechat/SKILL.md:69-80 maxhub-wechat/SKILL.md:80-81 maxhub-wechat/SKILL.md:81-91 maxhub-wechat/SKILL.md:91-92 maxhub-wechat/SKILL.md:92-106 maxhub-wechat/SKILL.md:106-107 maxhub-wechat/SKILL.md:107-165 SKILL.md:34 SKILL.md:67 SKILL.md:68 SKILL.md:69 SKILL.md:70 SKILL.md:71 SKILL.md:72 SKILL.md:73 SKILL.md:79 SKILL.md:80 SKILL.md:81 SKILL.md:82 SKILL.md:83 SKILL.md:84 SKILL.md:85 SKILL.md:86 SKILL.md:87 SKILL.md:88 SKILL.md:94 SKILL.md:95 SKILL.md:96 SKILL.md:100-139 SKILL.md:139-145 SKILL.md:145-151 SKILL.md:151-161 SKILL.md:161-162 SKILL.md:162-163 SKILL.md:163-164 SKILL.md:164-165 SKILL.md:165-166 SKILL.md:166-167 SKILL.md:167-173 SKILL.md:173-174 SKILL.md:174-175 SKILL.md:175-176 SKILL.md:176-177 SKILL.md:177-178 SKILL.md:178-179 SKILL.md:179-180 SKILL.md:180-181 SKILL.md:181-182 SKILL.md:182-183 SKILL.md:183-189 SKILL.md:189-190 SKILL.md:190-191 SKILL.md:191-192 SKILL.md:192 SKILL.md:193-197 SKILL.md:197-199 SKILL.md:199-201 SKILL.md:201-205 SKILL.md:205-211
Audited by: codex View Audit History โ
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/xiewxx-maxhub-skills/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/xiewxx-maxhub-skills?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/xiewxx-maxhub-skills?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/xiewxx-maxhub-skills/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/xiewxx-maxhub-skills.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA ยท BibTeX ยท CFF)
APA citation
XieWxx. (2026). maxhub-skills security audit report (audit version 4) [Author version 3.2.0]. Skillstore. https://skillstore.io/skills/xiewxx-maxhub-skills/audits/4BibTeX citation
@techreport{xiewxx-xiewxx-maxhub-skills-2026,
author = {XieWxx},
title = {maxhub-skills security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/xiewxx-maxhub-skills/audits/4},
note = {Author version 3.2.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "maxhub-skills security audit report (audit version 4)"
version: "3.2.0"
type: report
authors:
- name: "XieWxx"
date-released: "2026-07-08"
url: "https://skillstore.io/skills/xiewxx-maxhub-skills/audits/4"
identifiers:
- type: other
value: "skillstore:xiewxx-maxhub-skills:audit:4"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
100
Maintainability
87
Content
68
Community
100
Spec Compliance
What You Can Build
Monitor Social Trends
Query search and trending endpoints to summarize platform activity for a topic or creator.
Research Creator Performance
Collect profile, post, comment, and engagement data for structured creator analysis.
Compare Platform Signals
Use matched endpoints across supported platforms to compare audiences, content, and topic momentum.
Try These Prompts
Find Basic Profile Data
Use MaxHub to find public profile data for this account: [account or URL]. Summarize the source, key fields, and limits.
Search Recent Content
Search [platform] for [keyword]. Return notable posts, creators, dates, engagement signals, and any missing data.
Analyze Creator Activity
Analyze [creator] on [platform]. Gather profile, recent posts, comments, and engagement patterns, then explain useful trends.
Compare Multi-Platform Signals
Compare [topic] across [platforms]. Plan the MaxHub calls, note credential risks, summarize findings, and separate evidence from inference.
Best Practices
- Use scoped API keys and rotate them after sensitive investigations.
- Limit each request to the minimum platform, endpoint, and page count needed.
- Treat platform cookies as highly sensitive and avoid using personal accounts.
Avoid
- Do not paste full browser cookies unless the endpoint truly requires them.
- Do not use endpoints intended for metric manipulation or platform bypass.
- Do not assume returned third-party data is complete, current, or authorized.
Frequently Asked Questions
Does this skill work without a MaxHub API key?
No. The documentation requires MAXHUB_API_KEY or a configured MaxHub key before API calls can run.
Which tools can use this skill?
The generated metadata lists Claude, Codex, and Claude Code as supported tools.
Does it only query public data?
Not always. Some TikTok endpoints document user cookies, account-specific data, and security helper functions.
Where are requests sent?
The skill documents https://www.aconfig.cn as the MaxHub base URL for API requests.
Can it perform analysis after fetching data?
Yes. The skill routes requests and asks the assistant to summarize, compare, and analyze returned data.
What should users review before installing?
Review credential handling, cookie requirements, and risky TikTok security or metric endpoints before use.
Developer Details
Author
XieWxxLicense
MIT-0
Author version
v3.2.0
Skillstore revision
r1
Ref
64ca8af0f54a325752f08bd54e52151061ea659a
Maintenance freshness
7/21/2026
Usage
3 downloads ยท 73 views
File structure
๐ maxhub-lemon8/
๐ references/
๐ api-post-user.md
๐ param-mappings.md
๐ _meta.json
๐ README_CN.md
๐ README.md
๐ SKILL.md
๐ maxhub-tiktok/
๐ references/
๐ api-ads-analytics.md
๐ api-search.md
๐ api-user.md
๐ api-video.md
๐ param-mappings.md
๐ _meta.json
๐ README_CN.md
๐ README.md
๐ SKILL.md
๐ maxhub-toutiao/
๐ references/
๐ api-content-user.md
๐ param-mappings.md
๐ _meta.json
๐ README_CN.md
๐ README.md
๐ SKILL.md
๐ maxhub-wechat/
๐ references/
๐ api-channels.md
๐ api-mp.md
๐ param-mappings.md
๐ _meta.json
๐ README_CN.md
๐ README.md
๐ SKILL.md
๐ LICENSE
๐ README.md
๐ RECOMMENDATION.md
๐ SKILL.md
More from XieWxx
View all๐ฆ
maxhub-hybrid
77Parse Hybrid Video Content with MaxHub
Teams need a consistent way to parse public video links across supported platforms. This skill guides MaxHub HybridParser calls with clear limits and API key handling.
Data & Analytics View
๐ฆ
maxhub-lemon8
73Explore Lemon8 Content Data
Lemon8 research often requires searching posts, profiles, topics, and trends across several endpoints. This skill routes requests to MaxHub APIs and returns concise discovery, comparison, and analysis results.
Research & Learning View
๐ฆ
maxhub-tiktok
38Analyze TikTok Data With MaxHub
TikTok research often needs many video, user, search, and ad endpoints. This skill routes requests through MaxHub references and returns structured summaries.
Data & Analytics View
๐ฆ
maxhub-wechat
38Analyze WeChat Public Data with MaxHub
Teams need reliable WeChat public data for content and account analysis. This skill queries MaxHub endpoints for Channels and Official Accounts and summarizes results.
Data & Analytics View
Related Skills
View all๐ฆ
senior-data-scientist
81Design Data Science Experiments and Models
by alirezarezvani
Data science projects often fail when experiments, features, and models lack clear statistical structure. This skill gives Claude, Codex, and Claude Code guided workflows for experimentation, feature engineering, and model review.
Data & Analytics View
๐ฆ
data-storytelling
79Transform Data Into Decision Stories
by wshobson
Raw metrics often fail to guide stakeholder decisions. This skill turns analysis into clear narratives, visual structures, and action plans.
Data & Analytics View
๐ฆ
business-analyst
79Analyze Business Performance with BI Guidance
by sickn33
Teams often struggle to turn metrics, dashboards, and research into clear business decisions. This skill structures analysis, KPI design, forecasting, and recommendations for Claude, Codex, and Claude Code.
Data & Analytics View
๐ฆ
sql-queries-tool
79Generate SQL Queries for DBX Studio
by Dbxstudio
Database users need reliable SQL that matches their connection type and schema. This skill guides Claude, Codex, and Claude Code to inspect schemas, write read-only queries, and explain results clearly.
Data & Analytics View
๐ฆ
data-orchestrator
79Coordinate Data Pipelines and Quality Checks
by Brownbull
Data pipeline work can become inconsistent when ingestion, features, quality, and reporting are planned separately. This skill organizes data tasks around pipeline context, quality gates, lineage, and handoffs.
Data & Analytics View
๐ฆ
segment-cdp
78Build Segment CDP Tracking Plans
by sickn33
Segment implementations often lose consistency across browser, server, and destination workflows. This skill gives Claude, Codex, and Claude Code structured guidance for tracking design and governance.
Data & Analytics View