技能 tophub-trends
📦
tophub-trends
内容修订 r1 高风险 ⚙️ 外部命令🌐 网络访问📁 文件系统访问🔑 环境变量
分析 TopHub 趋势以获取内容创意
创作者需要一种快速方法，将每日热门榜单转化为有用的选题创意。此技能会获取 TopHub 趋势，请 Claude 分析流量潜力，并保存 Markdown 报告。
支持: Claude Codex Code(CC)
安装前请停下并请求确认。
请审查安装计划，并在更改文件前获得用户明确同意。
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "tophub-trends" from https://skillstore.io/skills/wangdefou-dev-tophub-trends.md and its manifest at https://skillstore.io/api/skills/wangdefou-dev-tophub-trends/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“tophub-trends”。 获取最新 TopHub trends 并分析排名靠前的条目。
预期结果:
一份 Markdown 报告，列出高潜力话题、建议内容角度，以及每个角度可能吸引关注的简短说明。
正在使用“tophub-trends”。 使用 mock mode 测试工作流。
预期结果:
在不调用 Anthropic API 的情况下，本地保存一份示例 Markdown 报告。
正在使用“tophub-trends”。 保存源趋势数据以供后续审查。
预期结果:
一个带时间戳的原始数据文件和一份对应的分析报告会写入 trends output folder。
安全审计
高风险v10 • 2026/7/7 打开版本化报告
Most command-execution and obfuscation detections are false positives caused by Markdown backticks, JavaScript template literals, Cheerio selector syntax, or Chinese text entropy. Real risks remain: the skill loads a parent .env file, handles an Anthropic API key, supports a configurable API base URL, fetches external TopHub content, writes local files, and sends untrusted web content into a Claude prompt.
2
已扫描文件
226
分析行数
22
复核项
0
已忽略误报
已确认安全问题 (5)
高
Environment file access
确保 `defou-workflow-agent/.env` 文件中已配置以下环境变量:
The documentation references a project .env file that stores API configuration. The code also loads that file, so this is a real sensitive-file concern.
高
Environment file access
const envPath = path.join(projectRoot, '.env');
The code builds a path to the parent project .env file. This is a direct reference to sensitive configuration storage.
高
Environment file access
const ANTHROPIC_API_KEY = process.env.ANTHROPIC_API_KEY;
The code reads ANTHROPIC_API_KEY after loading the .env file. This is sensitive credential access.
高
Environment file access
const ANTHROPIC_BASE_URL = process.env.ANTHROPIC_BASE_URL;
The code reads ANTHROPIC_BASE_URL after loading .env. This can direct API requests to a configured endpoint.
中
Untrusted Web Content Included In Claude Prompt
TopHub titles, sources, heat labels, and links are fetched from external HTML and inserted directly into the Claude user prompt. A malicious or compromised trend item could influence the generated report through prompt injection.
The code formats scraped TopHub items into itemsText and embeds it in the model prompt without delimiting the data as untrusted. This creates a plausible indirect prompt injection path, although impact is limited to generated content.
能力复核项 (22)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
高
Generic API/secret keys
- `ANTHROPIC_API_KEY`: Anthropic API Key
The documentation requires an ANTHROPIC_API_KEY. This is a real credential dependency that must be handled carefully.
高
Path resolve with ..
const projectRoot = path.resolve(__dirname, '../../');
The code resolves two parent directories from the skill location to define projectRoot. There is no user input, but it intentionally expands access outside the skill directory.
高
Path traversal sequence
const projectRoot = path.resolve(__dirname, '../../');
The ../.. traversal is hardcoded rather than injected, but it is used to reach parent project files and outputs. This remains a real boundary-expansion concern.
高
Environment variable access (dot notation)
const ANTHROPIC_API_KEY = process.env.ANTHROPIC_API_KEY;
The code reads ANTHROPIC_API_KEY from the environment. This is a real secret access path.
高
Environment variable object
const ANTHROPIC_API_KEY = process.env.ANTHROPIC_API_KEY;
The process.env access reads ANTHROPIC_API_KEY. This is a real credential access path.
高
dotenv library
dotenv.config({ path: envPath, override: true });
The code loads environment values from the parent project .env file with override enabled. This can introduce or replace credentials used by the script.
高
Generic API/secret keys
const ANTHROPIC_API_KEY = process.env.ANTHROPIC_API_KEY;
ANTHROPIC_API_KEY is read from the environment and later supplied to the Anthropic client. This is direct API secret handling.
高
Generic API/secret keys
apiKey: ANTHROPIC_API_KEY || 'dummy',
The API key value is passed into the Anthropic SDK configuration. This is legitimate but sensitive credential use.
中
Hidden file access
确保 `defou-workflow-agent/.env` 文件中已配置以下环境变量:
The documentation directs users to configure a hidden .env file. This is legitimate setup guidance but involves sensitive local configuration.
中
Node.js fs operations
fs.mkdirSync(TRENDS_DIR, { recursive: true });
The code creates the trends output directory recursively. This is a real filesystem side effect, although the path is deterministic.
中
Node.js fs operations
fs.writeFileSync(rawPath, JSON.stringify(items, null, 2));
The code writes fetched trend data to a local JSON file. This is intended output but is a real filesystem write.
中
Node.js fs operations
fs.writeFileSync(reportPath, finalContent);
The code writes the generated analysis report to a local Markdown file. This is intended output but is a real filesystem write.
中
Synchronous file operations
fs.writeFileSync(rawPath, JSON.stringify(items, null, 2));
The synchronous write stores fetched trend data on disk. This is a real local file modification.
中
Synchronous file operations
fs.writeFileSync(reportPath, finalContent);
The synchronous write stores the generated report on disk. This is a real local file modification.
中
Environment variable access (dot notation)
const ANTHROPIC_BASE_URL = process.env.ANTHROPIC_BASE_URL;
The code reads ANTHROPIC_BASE_URL, which can change the API endpoint used by the Anthropic client. This is configuration access with network impact.
中
Environment variable object
const ANTHROPIC_BASE_URL = process.env.ANTHROPIC_BASE_URL;
The process.env access reads ANTHROPIC_BASE_URL and can alter the remote API endpoint. This is relevant configuration access.
低
Hardcoded URL
1. **Fetch Hot List**: 抓取 TopHub (https://tophub.today/hot) 的实时热榜数据。
The documentation states that the skill fetches the TopHub hot page. This is a disclosed but real external network dependency.
低
Fetch API call
const response = await fetch(TOPHUB_URL, {
The code performs an HTTP fetch to TopHub. This is intended functionality but real network egress.
低
HTTP client library
import fetch from 'node-fetch';
The node-fetch import supports the actual TopHub request later in the file. This confirms a real network capability.
低
Hardcoded URL
const TOPHUB_URL = 'https://tophub.today/hot';
The code hardcodes the TopHub hot list URL as the fetch target. This is a real external endpoint dependency.
低
Hardcoded URL
const fullLink = link.startsWith('http') ? link : `https://tophub.today${link}`;
The code constructs absolute TopHub links from relative URLs. This is expected but still embeds an external domain.
低
Node.js fs stat operations
if (fs.existsSync(envPath)) {
The code checks whether the parent project .env file exists. This touches sensitive configuration state, even though it does not read values directly.
风险因素
⚙️ 外部命令 (25)
SKILL.md:22-25 SKILL.md:25-29 SKILL.md:29-31 SKILL.md:31-32 SKILL.md:32-36 SKILL.md:36-38 SKILL.md:38-39 SKILL.md:39-40 SKILL.md:40 tophub.ts:13 tophub.ts:55 tophub.ts:63 tophub.ts:78 tophub.ts:106 tophub.ts:109-123 tophub.ts:128 tophub.ts:151 tophub.ts:155 tophub.ts:159 tophub.ts:165 tophub.ts:168 tophub.ts:171 tophub.ts:70 tophub.ts:71 tophub.ts:63-78
📁 文件系统访问 (10)
审计者: codex 查看审计历史 →
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/wangdefou-dev-tophub-trends/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/wangdefou-dev-tophub-trends?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/wangdefou-dev-tophub-trends?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/wangdefou-dev-tophub-trends/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/wangdefou-dev-tophub-trends.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
wangdefou-dev. (2026). tophub-trends security audit report (audit version 10) [Author version unspecified]. Skillstore. https://skillstore.io/skills/wangdefou-dev-tophub-trends/audits/10BibTeX 引用
@techreport{wangdefou-dev-wangdefou-dev-tophub-trends-2026,
author = {wangdefou-dev},
title = {tophub-trends security audit report (audit version 10)},
institution = {Skillstore},
year = {2026},
number = {10},
url = {https://skillstore.io/skills/wangdefou-dev-tophub-trends/audits/10},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "tophub-trends security audit report (audit version 10)"
version: "unspecified"
type: report
authors:
- name: "wangdefou-dev"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/wangdefou-dev-tophub-trends/audits/10"
identifiers:
- type: other
value: "skillstore:wangdefou-dev-tophub-trends:audit:10"
description: "Skillstore immutable audit report identifier"
Skillstore 评分
评分依据 证据置信度: 中 55
架构
85
可维护性
85
内容
70
社区
83
规范符合性
你能构建什么
规划每日创作者选题
查看当前 TopHub 话题，并获得适用于短视频、帖子或新闻简报的推荐角度。
支持编辑会议
在决定哪些报道值得深入覆盖之前，快速生成一份趋势简报。
追踪市场关注度
保存原始热门榜单数据和分析报告，以便后续按日期进行比较。
试试这些提示
运行基础趋势报告
使用 TopHub trends skill 获取最新热门榜单，并创建一份包含选题建议的 Markdown 报告。
生成更安全的内容角度
分析最新 TopHub trends，并建议避免误导性声明、骚扰和未经证实猜测的内容角度。
按受众匹配度比较话题
获取 TopHub trends，并为关注生产力的受众对最佳机会进行排序。解释每个话题为什么适合或不适合。
创建编辑简报
运行 TopHub trend analysis，然后生成一份编辑简报，包含优先话题、风险、来源检查和推荐发布格式。
最佳实践
- 发布前审查生成的角度，确保准确性、公平性和品牌契合度。
- 使用可信的 Anthropic endpoint，并保护存储 API key 的 .env file。
- 在将任何趋势作为事实依据之前，先检查 TopHub source links。
避免
- 不要在未验证底层来源的情况下发布生成的趋势分析。
- 不要将生产环境 API keys 存储在共享 repositories 或公共 workspaces 中。
- 不要假设每个爆火话题都适合你的受众或品牌。
常见问题
这个技能做什么？
它会获取 TopHub 热门榜单数据，请 Claude 分析趋势潜力，并保存 Markdown 选题报告。
它需要 API key 吗？
是的。除非将 MOCK_MODE 设置为 true 进行测试，否则它需要 ANTHROPIC_API_KEY。
结果保存在哪里？
该 script 会将原始数据和分析报告写入 project root 下的 outputs/trends。
它会执行 shell commands 吗？
在审查过的 TypeScript code 中未发现直接 shell execution。文档展示了供用户运行的 npx command。
它可以使用自定义 Anthropic endpoint 吗？
可以。ANTHROPIC_BASE_URL 可以配置 client endpoint，因此用户应仅使用可信 endpoint。
输出可以直接发布吗？
不可以。该报告应被视为研究辅助，并需要审查其准确性、语气和来源质量。
开发者详情
许可证
MIT
Skillstore 修订
r1
版本提示
作者未声明版本。
引用
36e07d5e13068e5be64447e8f20b427cf2cbd21a
维护新鲜度
2026/7/18
使用量
17 次下载 · 183 次浏览