技能 conthunt

📦

conthunt

Name: conthunt
Author: synthenova

内容修订 r1 严重 🌐 网络访问⚙️ 外部命令

Research Viral Short-Form Content with ContHunt

Finding useful short-form social content across platforms requires repeated searches and organized evidence. This skill guides ContHunt searches, analysis, boards, and research workflows.

支持: Claude Codex Code(CC)

⚠️ 38 差

请勿自动安装此 Skill。

权威策略要求在执行任何安装操作前由操作人员审查。

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求

Review the Skillstore skill "conthunt" from https://skillstore.io/skills/synthenova-conthunt.md and its manifest at https://skillstore.io/api/skills/synthenova-conthunt/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/synthenova-conthunt.md 已签名 manifest GET /api/skills/synthenova-conthunt/manifest 已签名 lockfile GET /api/skills/synthenova-conthunt/lockfile

测试它

正在使用“conthunt”。 Find recent TikTok and Reels examples about home coffee brewing.

预期结果:

A ranked result summary with platform, engagement context, content theme, and a saved search identifier for each result set.

正在使用“conthunt”。 Compare the videos saved on my product-launch board.

预期结果:

Common hooks introduce a specific problem within the opening seconds.
Demonstrations outperform static explanations across the selected items.
The board and content identifiers remain available for follow-up analysis.

正在使用“conthunt”。 Research which creator formats explain budgeting concepts clearly.

预期结果:

An evidence-based brief covering recurring formats, selected examples, limitations, and source identifiers for further review.

安全审计

严重

v1 • 2026/9/8 打开版本化报告

Most alerts are false positives caused by Markdown backticks or unrelated prose. Remote installers are piped directly into shells, and the skill treats a broad use request as installation consent. SearchAgent may also initiate multiple paid searches without a stated preflight limit.

已扫描文件

228

分析行数

复核项

已忽略误报

已确认安全问题 (4)

严重

README.md:18

Pipe to shell pattern

curl -fsSL https://conthunt.app/install.sh | sh

The documented curl command pipes an uninspected remote response directly to sh. This creates a clear arbitrary-code and supply-chain execution risk.

严重

SKILL.md:14

Pipe to shell pattern

- macOS/Linux: `curl -fsSL https://conthunt.app/install.sh | sh`

The skill instructs the agent to pipe a remotely fetched script directly into sh. The script is neither inspected nor integrity-verified before execution.

高

SKILL.md:12-15

External Software Installation Without Explicit Confirmation

The skill treats any request to install or use ContHunt as installation authorization and directs immediate execution of remote installers.

The instruction explicitly says not to ask separately and immediately provides shell-based installers. This bypasses informed confirmation for an environment-changing action.

中

references/commands.md:34 SKILL.md:23

Paid Searches Lack a Preflight Limit

SearchAgent may issue multiple paid searches, but the instructions do not require cost disclosure, approval, or a user-defined spending limit before starting.

The reference explicitly states that SearchAgent can issue multiple paid searches. The operating instruction selects it by task type without requiring a spending confirmation.

能力复核项 (6)

这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。

高

SKILL.md:15

PowerShell invocation

- Windows PowerShell: `irm https://conthunt.app/install.ps1 | iex`

The instruction uses Invoke-RestMethod and Invoke-Expression to execute a remote response in PowerShell. This permits arbitrary code execution if delivery is compromised.

中

SKILL.md:14

Ruby/shell backtick execution

- macOS/Linux: `curl -fsSL https://conthunt.app/install.sh | sh`

Although the backticks are Markdown, the skill explicitly instructs the agent to execute this shell command. It runs an uninspected remote script.

中

SKILL.md:15

Ruby/shell backtick execution

- Windows PowerShell: `irm https://conthunt.app/install.ps1 | iex`

Although the backticks are Markdown, the enclosed PowerShell command is intended for execution. It evaluates an uninspected remote script.

低

README.md:18

Hardcoded URL

curl -fsSL https://conthunt.app/install.sh | sh

The URL supplies a remote installation script that is immediately executed by a shell. Compromise of the endpoint or delivery path could execute arbitrary code.

低

SKILL.md:14

Hardcoded URL

- macOS/Linux: `curl -fsSL https://conthunt.app/install.sh | sh`

The hardcoded endpoint provides executable installer content that is sent directly to sh. This network dependency can become an arbitrary-code delivery path.

低

SKILL.md:15

Hardcoded URL

- Windows PowerShell: `irm https://conthunt.app/install.ps1 | iex`

The hardcoded endpoint provides executable installer content that is passed directly to Invoke-Expression. Endpoint compromise could deliver arbitrary code.

风险因素

🌐 网络访问 (4)

README.md:18 SKILL.md:14 SKILL.md:15 SKILL.md:43

⚙️ 外部命令 (21)

检测到的模式

Pipe to shell pattern×2

审计者: codex

分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告

复制报告链接

https://skillstore.io/skills/synthenova-conthunt/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/synthenova-conthunt/security.svg)](https://skillstore.io/skills/synthenova-conthunt?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/synthenova-conthunt?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/synthenova-conthunt/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/synthenova-conthunt.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学术引用 (APA · BibTeX · CFF)

APA 引用

synthenova. (2026). conthunt security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/synthenova-conthunt/audits/1

BibTeX 引用

@techreport{synthenova-synthenova-conthunt-2026,
  author = {synthenova},
  title = {conthunt security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/synthenova-conthunt/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "conthunt security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "synthenova"
date-released: "2026-09-08"
url: "https://skillstore.io/skills/synthenova-conthunt/audits/1"
identifiers:
  - type: other
    value: "skillstore:synthenova-conthunt:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据证据置信度: 中

架构

可维护性

内容

社区

规范符合性

你能构建什么

Find Campaign References

Discover high-performing short videos in a niche and collect useful examples for campaign planning.

Compare Competitor Patterns

Search competitor topics, organize selected videos, and identify repeated formats, hooks, and audience signals.

Build Evidence-Based Briefs

Analyze relevant videos and retrieve focused evidence for editorial or creative briefs.

试试这些提示

Run a Basic Search

Search ContHunt for [topic] on [platform]. Show the strongest results and summarize why each result is relevant.

Explore a Content Niche

Use SearchAgent to explore [niche]. Ask before paid searches, limit work to [limit], and summarize promising themes with supporting results.

Analyze a Selected Board

Create or use board [board name]. Add the selected items, run insights, and compare their hooks, formats, and audience signals.

Conduct Deep Evidence Research

Research [question] using search [search ID] or board [board ID]. Track completion, review watched items, and return evidence with source identifiers.

最佳实践

Confirm platforms, date ranges, regions, and paid-search limits before starting.
Use machine-readable output and preserve returned identifiers for follow-up commands.
Poll job status at reasonable intervals and retrieve full results only after completion.

避免

Do not execute remote installation scripts without inspection, verification, and explicit approval.
Do not repeat paid operations after credits are exhausted or when a start result is uncertain.
Do not expose authentication tokens, signed media URLs, or unnecessary raw payloads.