maxhub-skills security assessment v1

MaxHub Skills is a documentation-only aggregation skill pack containing 20 platform-specific API reference modules (Bilibili, Douyin, Instagram, Kuaishou, Lemon8, LinkedIn, Pipixia, Reddit, Sora2, Temp-mail, Threads, TikTok, Toutiao, Twitter, WeChat, Weibo, Xiaohongshu, Xigua, YouTube, Zhihu). All files are Markdown (.md) and JSON (.json) — zero executable code was found. The 13,898 static analysis findings are all FALSE POSITIVES: (1) 9,304 'external_commands' detections are curl examples inside Markdown code blocks, (2) 825 'network' detections are API URLs in reference documentation, (3) 350 'env_access' detections are MAXHUB_API_KEY references in setup documentation. No prompt injection or hidden instructions were detected. Risk is LOW: the skill references external APIs via a documented single-domain API gateway (aconfig.cn) and requires a MAXHUB_API_KEY environment variable. Some API reference files document ethically sensitive operations (signature generation, metric manipulation endpoints claimed removed in v3.1.0, temp-mail service, device registration) — these are documented references for AI assistant use, not executable code. Cookie handling endpoints include appropriate security warnings. Recommended for publication with LOW risk classification.