審計歷史

This skill is a legitimate API wrapper for querying Kuaishou data through the MaxHub service (www.aconfig.cn). All 135 static findings have been evaluated as false positives: hardcoded URLs point to the documented API endpoint, shell commands are documentation examples for curl-based API calls, and env access is for the declared MAXHUB_API_KEY credential. The skill transparently declares its requirements and usage patterns. No malicious intent, obfuscation, or prompt injection detected.

Security evaluation completed. Static scanner flagged 134 potential issues, but review reveals all findings are false positives. The skill uses template variables in markdown documentation (e.g. ${MAXHUB_API_KEY}) which triggered command execution alerts. Network and environment variable detections are intentional design - the skill is designed to communicate only with MaxHub API using environment-provided credentials. The skill explicitly documents its security boundaries in metadata.