审计历史

This skill is an API wrapper for querying PiPiXia social media data through the MaxHub API. All 225 static analysis findings are false positives. URLs point to the legitimate MaxHub API service at aconfig.cn. Shell execution patterns are markdown code examples showing curl commands for API access. Environment variable MAXHUB_API_KEY is properly declared with sensitive flag and used only for API authentication. No obfuscation, data exfiltration, or malicious patterns were found.

Static analyzer flagged 96 potential issues as NEEDS_AI. Manual semantic evaluation reveals all findings are FALSE POSITIVES. Backtick patterns are markdown code fences (not Ruby execution), env_access references are legitimate API key usage for MaxHub authentication, and network URLs are the documented MaxHub API endpoints. No actual malicious behavior detected. The skill is a legitimate PiPiXia data collection tool with explicit security documentation.