技能 maxhub-tiktok

📦

maxhub-tiktok

Name: maxhub-tiktok
Author: XieWxx

v3.2.0 内容修订 r1 高风险 🌐 网络访问🔑 环境变量⚙️ 外部命令

使用 MaxHub API 分析 TikTok 数据

TikTok 研究通常需要许多独立端点，并且需要谨慎选择参数。此技能会路由请求，并为视频、用户、搜索、广告和店铺分析格式化结果。

支持: Claude Codex Code(CC)

⚠️ 38 差

安装前请停下并请求确认。

请审查安装计划，并在更改文件前获得用户明确同意。

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求

Review the Skillstore skill "maxhub-tiktok" from https://skillstore.io/skills/xiewxx-maxhub-tiktok.md and its manifest at https://skillstore.io/api/skills/xiewxx-maxhub-tiktok/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/xiewxx-maxhub-tiktok.md 已签名 manifest GET /api/skills/xiewxx-maxhub-tiktok/manifest 已签名 lockfile GET /api/skills/xiewxx-maxhub-tiktok/lockfile

测试它

正在使用“maxhub-tiktok”。 Analyze @samplecreator for a possible sponsorship.

预期结果:

创作者概览，包括粉丝数、近期视频主题、互动范围、受众匹配度、内容风险和建议。

正在使用“maxhub-tiktok”。 Find trending TikTok products for beauty in the United States.

预期结果:

排名靠前的产品主题
代表性视频和店铺
互动信号
建议的下一步研究方向

正在使用“maxhub-tiktok”。 Compare ads for wireless earbuds.

预期结果:

并排总结广告开场钩子、产品主张、受众信号、创意形式和可能的测试机会。

安全审计

高风险

v4 • 2026/7/8 打开版本化报告

Most static hits are Markdown documentation false positives, including backticks, endpoint IDs, sample URLs, and bilingual text. Confirmed risk remains because the skill handles a MaxHub API key, may transmit TikTok cookies, and documents anti-abuse and interaction capabilities.

已扫描文件

9,970

分析行数

复核项

已忽略误报

已确认安全问题 (3)

高

SKILL.md:47-50 SKILL.md:67-75 references/api-user.md:165-181

Credential and Session Cookie Transmission to Third Party

The skill sends MAXHUB_API_KEY as a Bearer token to MaxHub and warns that some endpoints may require platform session cookies.

The credential header and cookie requirements are explicit in the skill and reference files. This is intentional third-party credential handling, not scanner noise.

高

references/api-video.md:7-33 references/api-video.md:3158-3185 references/api-video.md:3971-4001

Anti-Abuse Token and Guest Cookie Generation

The references include endpoints for TikTok encryption headers, guest cookies, real msToken generation, and randomized browser fingerprint data.

The documentation directly describes generating TikTok request headers, guest cookies, and randomized browser fingerprint data for crawler resistance.

高

SKILL.md:80-82 README.md:14-15 references/api-video.md:6364-6388

Read-Only Claim Conflicts With Interaction Actions

The skill claims read-only operation, but README content lists like, follow, comment, collect, and forward actions, and references include private-message deep links.

The read-only statement is explicit, while separate files advertise interaction actions and a private-message deep link. Some actions may only generate links, but the scope mismatch is real.

能力复核项 (9)

这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。

高

references/api-ads-analytics.md:4

Generic API/secret keys

Auth: `Authorization: Bearer $MAXHUB_API_KEY`

This instructs use of MAXHUB_API_KEY as a Bearer token for MaxHub API calls. The token is intentionally sent to a third-party service.

高

references/api-search.md:4

Generic API/secret keys

Auth: `Authorization: Bearer $MAXHUB_API_KEY`

This instructs use of MAXHUB_API_KEY as a Bearer token for MaxHub API calls. The token is intentionally sent to a third-party service.

高

references/api-user.md:4

Generic API/secret keys

Auth: `Authorization: Bearer $MAXHUB_API_KEY`

This instructs use of MAXHUB_API_KEY as a Bearer token for MaxHub API calls. The token is intentionally sent to a third-party service.

高

references/api-video.md:4

Generic API/secret keys

Auth: `Authorization: Bearer $MAXHUB_API_KEY`

This instructs use of MAXHUB_API_KEY as a Bearer token for MaxHub API calls. The token is intentionally sent to a third-party service.

高

SKILL.md:10

Generic API/secret keys

primaryEnv: MAXHUB_API_KEY

The skill declares MAXHUB_API_KEY as a required sensitive environment value. This is expected for the API integration but grants the skill access to a secret.

高

SKILL.md:13

Generic API/secret keys

- MAXHUB_API_KEY

The skill declares MAXHUB_API_KEY as a required sensitive environment value. This is expected for the API integration but grants the skill access to a secret.

高

SKILL.md:17

Generic API/secret keys

- name: MAXHUB_API_KEY

The skill declares MAXHUB_API_KEY as a required sensitive environment value. This is expected for the API integration but grants the skill access to a secret.

高

SKILL.md:47

Generic API/secret keys

Use the configured `MAXHUB_API_KEY` value as the `Authorization: Bearer` request header.

This instructs use of MAXHUB_API_KEY as a Bearer token for MaxHub API calls. The token is intentionally sent to a third-party service.

高

SKILL.md:50

Generic API/secret keys

maxhub_auth_header="Authorization: Bearer ${MAXHUB_API_KEY}"

This instructs use of MAXHUB_API_KEY as a Bearer token for MaxHub API calls. The token is intentionally sent to a third-party service.

风险因素

🌐 网络访问 (64)

🔑 环境变量 (16)

README_CN.md:26 README.md:26 references/api-ads-analytics.md:4 references/api-search.md:4 references/api-user.md:4 references/api-video.md:4 SKILL.md:10 SKILL.md:13 SKILL.md:17 SKILL.md:47 SKILL.md:50 SKILL.md:89 SKILL.md:101 SKILL.md:102 SKILL.md:112 SKILL.md:113

⚙️ 外部命令 (19)

SKILL.md:45 SKILL.md:47 SKILL.md:49-61 SKILL.md:61-75 SKILL.md:75-77 SKILL.md:77-88 SKILL.md:88-90 SKILL.md:90-101 SKILL.md:101-102 SKILL.md:102-112 SKILL.md:112-113 SKILL.md:113-127 SKILL.md:127-128 SKILL.md:128-129 SKILL.md:129-130 SKILL.md:130-131 SKILL.md:131-132 SKILL.md:132-133 SKILL.md:133-192

审计者: codex 查看审计历史 →

分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告

复制报告链接

https://skillstore.io/skills/xiewxx-maxhub-tiktok/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/xiewxx-maxhub-tiktok/security.svg)](https://skillstore.io/skills/xiewxx-maxhub-tiktok?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/xiewxx-maxhub-tiktok?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/xiewxx-maxhub-tiktok/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/xiewxx-maxhub-tiktok.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学术引用 (APA · BibTeX · CFF)

APA 引用

XieWxx. (2026). maxhub-tiktok security audit report (audit version 4) [Author version 3.2.0]. Skillstore. https://skillstore.io/skills/xiewxx-maxhub-tiktok/audits/4

BibTeX 引用

@techreport{xiewxx-xiewxx-maxhub-tiktok-2026,
  author = {XieWxx},
  title = {maxhub-tiktok security audit report (audit version 4)},
  institution = {Skillstore},
  year = {2026},
  number = {4},
  url = {https://skillstore.io/skills/xiewxx-maxhub-tiktok/audits/4},
  note = {Author version 3.2.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "maxhub-tiktok security audit report (audit version 4)"
version: "3.2.0"
type: report
authors:
  - name: "XieWxx"
date-released: "2026-07-08"
url: "https://skillstore.io/skills/xiewxx-maxhub-tiktok/audits/4"
identifiers:
  - type: other
    value: "skillstore:xiewxx-maxhub-tiktok:audit:4"
    description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据证据置信度: 中

架构

100

可维护性

内容

社区

100

规范符合性

你能构建什么

评估创作者合作

在外联前比较创作者资料、视频、受众信号和表现指标。

研究 TikTok 广告趋势

搜索广告、检查创意模式，并总结互动信号以用于营销活动规划。

跟踪产品和店铺需求

查看产品列表、店铺数据、评论和区域趋势信号，以支持电商决策。

试试这些提示

查找 TikTok 视频

查找此 TikTok 视频 URL 的详细信息，并总结观看量、点赞数、评论数、作者和发布时间。

分析创作者

分析 TikTok 创作者 @username。包括个人资料数据、近期视频表现、受众信号和合作风险。

比较广告示例

在美国搜索此产品类别的 TikTok 广告。按创意角度和互动表现比较排名靠前的结果。

构建区域趋势报告

为此细分领域创建一份覆盖三个区域的 TikTok 趋势报告。结合搜索、视频、创作者、产品和广告信号。

最佳实践

使用范围受限的 API 凭证，并在敏感研究后轮换它们。
先从只读查询和分析端点开始，再使用高级工具。
在每份报告中记录区域、日期范围和端点限制。

避免

除非你信任该第三方服务，否则不要粘贴完整的浏览器 cookies。
未经明确授权，不要使用指标操纵或互动端点。
不要将第三方 API 输出视为已验证的平台事实。

常见问题

此技能是否需要 API key？

是。MaxHub API 请求需要 MAXHUB_API_KEY。

请求会发送到哪里？

请求会发送到 https://www.aconfig.cn，即 MaxHub API 服务。

它能分析创作者和广告吗？

可以。参考资料涵盖创作者、广告、搜索、视频、产品和店铺工作流。

它是只读的吗？

该技能声称为只读使用，但参考资料包含需要审核的互动和指标相关能力。

它支持中文和英文吗？

是。该技能包含面向中文和英文用户的响应规则。

它适合在 marketplace 发布吗？

没有人工审核则不安全。凭证处理、第三方请求以及可能存在的互动端点会带来高风险。

开发者详情

作者

XieWxx

许可证

MIT-0

作者版本

v3.2.0

Skillstore 修订

仓库

https://github.com/XieWxx/maxhub-api-skills/tree/main/maxhub-tiktok

引用

64ca8af0f54a325752f08bd54e52151061ea659a

维护新鲜度

2026/7/21

使用量

7 次下载 · 82 次浏览

文件结构

📁 references/

📄 api-ads-analytics.md

📄 api-search.md

📄 api-user.md

📄 api-video.md

📄 param-mappings.md

📄 _meta.json

📄 README_CN.md

📄 README.md

📄 SKILL.md