📦
maxhub-toutiao
81使用 MaxHub 查詢 Toutiao 資料
團隊需要快速存取 Toutiao 文章、影片、使用者和留言資料。此技能會引導 Claude、Codex 和 Claude Code 查詢 MaxHub API 並摘要結果。
效率 查看
技能 maxhub-skills
📦
maxhub-skills
v3.2.0 內容修訂 r1 嚴重 🌐 網路存取🔑 環境變數⚙️ 外部命令
查詢 MaxHub 社群平台 API
團隊需要一個地方來檢視社群平台 API 參考資料並規劃資料查詢。此 skill 會為 Claude、Codex 和 Claude Code 工作流程整理 MaxHub endpoint、參數與使用模式。
支援: Claude Codex Code(CC)
請勿自動安裝此 Skill。
權威政策要求在執行任何安裝操作前由操作人員審查。
使用我的智慧代理安裝
將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。
智能體請求
Review the Skillstore skill "maxhub-skills" from https://skillstore.io/skills/xiewxx-maxhub-skills.md and its manifest at https://skillstore.io/api/skills/xiewxx-maxhub-skills/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。
Agent 可讀資源
當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。
測試它
正在使用「maxhub-skills」。 Find the safest way to query TikTok creator analytics.
預期結果:
此 skill 會識別 creator analytics endpoint 群組、列出必要的 MaxHub authentication，並警告不要使用 cookie-based 或 signature-generation helpers。
正在使用「maxhub-skills」。 Compare WeChat and Lemon8 search capabilities.
預期結果:
此 skill 會摘要各平台可用的 search 和 content endpoints，然後說明參數需求、pagination 限制與 credential 邊界。
正在使用「maxhub-skills」。 Review whether I should use a signing helper endpoint.
預期結果:
此 skill 會將 signing helpers 標記為高風險，並建議避免 anti-bot bypass 或 platform-protection workflows。
安全審計
嚴重v4 • 2026/7/8 開啟版本化報告
Most static command, network, blocker, and obfuscation matches are documentation false positives. I confirmed credential handling risk for MAXHUB_API_KEY and added semantic findings for TikTok security bypass helpers, metric manipulation, user-cookie forwarding, and a security pre-approval claim. The skill should not be published until those high-risk capabilities and claims are removed or isolated.
33
已掃描檔案
13,250
分析行數
67
複核項目
0
已忽略的誤報
已確認的安全問題 (4)
嚴重
maxhub-tiktok/SKILL.md:127-133maxhub-tiktok/references/api-video.md:7-35maxhub-tiktok/references/api-video.md:3916-4118
Platform Security Bypass Helpers Exposed
The TikTok routes include helpers for request signatures, encryption, fingerprints, msToken values, device registration, and guest cookies. These capabilities can support bypassing platform anti-automation controls.
The endpoint names and descriptions directly reference signatures, encryption, fingerprints, msToken generation, and device registration. This is strong semantic evidence of platform security bypass tooling.
嚴重
Metric Manipulation Endpoint Exposed
The TikTok API reference documents a function that increases a video play count and returns a success status. This is a platform manipulation capability, not a read-only data query.
The cited description says the endpoint increases a work video play count and reports success or failure. That directly supports business-logic abuse and contradicts read-only positioning.
高
maxhub-tiktok/SKILL.md:66-78maxhub-tiktok/references/api-user.md:96-114maxhub-tiktok/references/api-user.md:161-181
User Cookie Forwarding to Third Party
Several TikTok endpoints accept or require user cookies for account-specific data. Forwarding browser cookies to MaxHub can expose account sessions and private user data.
The documentation explicitly warns that some endpoints require platform session cookies and shows cookie parameters. Cookies can authorize account access beyond simple public data retrieval.
高
Prompt Injection Attempt Detected
RECOMMENDATION.md claims the skill has passed ClawHub security review. Security pre-approval claims can bias automated review and must not be treated as authoritative.
The file contains a direct security-approval claim in marketplace-facing prose. It does not issue an explicit override command, so confidence is high but not maximal.
能力複核項目 (67)
這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。
高
Generic API/secret keys
2. 配置:`openclaw config set skills.entries.maxhub-lemon8.apiKey "<你的-key>"` 或 `export MAXHUB_API_KEY=
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
2. Configure: `openclaw config set skills.entries.maxhub-lemon8.apiKey "<your-key>"` or `export MAXH
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
Auth: `Authorization: Bearer $MAXHUB_API_KEY`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
Auth: `Authorization: Bearer $MAXHUB_API_KEY`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
primaryEnv: MAXHUB_API_KEY
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
- MAXHUB_API_KEY
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
- name: MAXHUB_API_KEY
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
Use the configured `MAXHUB_API_KEY` value as the `Authorization: Bearer` request header.
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
maxhub_auth_header="Authorization: Bearer ${MAXHUB_API_KEY}"
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
[ -n "${MAXHUB_API_KEY:-}" ] && echo "ok" || echo "missing"
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
> - OpenClaw/ClawHub:`openclaw config set skills.entries.maxhub-lemon8.apiKey "你的_API_KEY"`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
> - 通用环境变量:`export MAXHUB_API_KEY="你的_API_KEY"`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
> - OpenClaw/ClawHub: `openclaw config set skills.entries.maxhub-lemon8.apiKey "YOUR_API_KEY"`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
> - Generic: `export MAXHUB_API_KEY="YOUR_API_KEY"`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
2. 配置:`openclaw config set skills.entries.maxhub-tiktok.apiKey "<你的-key>"` 或 `export MAXHUB_API_KEY=
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
2. Configure: `openclaw config set skills.entries.maxhub-tiktok.apiKey "<your-key>"` or `export MAXH
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
Auth: `Authorization: Bearer $MAXHUB_API_KEY`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
Auth: `Authorization: Bearer $MAXHUB_API_KEY`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
Auth: `Authorization: Bearer $MAXHUB_API_KEY`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
Auth: `Authorization: Bearer $MAXHUB_API_KEY`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
primaryEnv: MAXHUB_API_KEY
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
- MAXHUB_API_KEY
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
- name: MAXHUB_API_KEY
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
Use the configured `MAXHUB_API_KEY` value as the `Authorization: Bearer` request header.
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
maxhub_auth_header="Authorization: Bearer ${MAXHUB_API_KEY}"
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
[ -n "${MAXHUB_API_KEY:-}" ] && echo "ok" || echo "missing"
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
> - OpenClaw/ClawHub:`openclaw config set skills.entries.maxhub-tiktok.apiKey "你的_API_KEY"`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
> - 通用环境变量:`export MAXHUB_API_KEY="你的_API_KEY"`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
> - OpenClaw/ClawHub: `openclaw config set skills.entries.maxhub-tiktok.apiKey "YOUR_API_KEY"`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
> - Generic: `export MAXHUB_API_KEY="YOUR_API_KEY"`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
2. 配置:`openclaw config set skills.entries.maxhub-toutiao.apiKey "<你的-key>"` 或 `export MAXHUB_API_KEY
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
2. Configure: `openclaw config set skills.entries.maxhub-toutiao.apiKey "<your-key>"` or `export MAX
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
Auth: `Authorization: Bearer $MAXHUB_API_KEY`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
primaryEnv: MAXHUB_API_KEY
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
- MAXHUB_API_KEY
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
- name: MAXHUB_API_KEY
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
Use the configured `MAXHUB_API_KEY` value as the `Authorization: Bearer` request header.
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
maxhub_auth_header="Authorization: Bearer ${MAXHUB_API_KEY}"
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
[ -n "${MAXHUB_API_KEY:-}" ] && echo "ok" || echo "missing"
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
> - OpenClaw/ClawHub:`openclaw config set skills.entries.maxhub-toutiao.apiKey "你的_API_KEY"`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
> - 通用环境变量:`export MAXHUB_API_KEY="你的_API_KEY"`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
> - OpenClaw/ClawHub: `openclaw config set skills.entries.maxhub-toutiao.apiKey "YOUR_API_KEY"`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
> - Generic: `export MAXHUB_API_KEY="YOUR_API_KEY"`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
2. 配置:`openclaw config set skills.entries.maxhub-wechat.apiKey "<你的-key>"` 或 `export MAXHUB_API_KEY=
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
2. Configure: `openclaw config set skills.entries.maxhub-wechat.apiKey "<your-key>"` or `export MAXH
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
Auth: `Authorization: Bearer $MAXHUB_API_KEY`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
Auth: `Authorization: Bearer $MAXHUB_API_KEY`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
primaryEnv: MAXHUB_API_KEY
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
- MAXHUB_API_KEY
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
- name: MAXHUB_API_KEY
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
Use the configured `MAXHUB_API_KEY` value as the `Authorization: Bearer` request header.
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
maxhub_auth_header="Authorization: Bearer ${MAXHUB_API_KEY}"
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
[ -n "${MAXHUB_API_KEY:-}" ] && echo "ok" || echo "missing"
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
> - OpenClaw/ClawHub:`openclaw config set skills.entries.maxhub-wechat.apiKey "你的_API_KEY"`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
> - 通用环境变量:`export MAXHUB_API_KEY="你的_API_KEY"`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
> - OpenClaw/ClawHub: `openclaw config set skills.entries.maxhub-wechat.apiKey "YOUR_API_KEY"`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
> - Generic: `export MAXHUB_API_KEY="YOUR_API_KEY"`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
export MAXHUB_API_KEY=mh_sk_your_api_key_here
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
export MAXHUB_API_KEY=mh_sk_your_api_key_here
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
export MAXHUB_API_KEY=mh_sk_your_api_key_here
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
primaryEnv: MAXHUB_API_KEY
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
- MAXHUB_API_KEY
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
- name: MAXHUB_API_KEY
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
所有技能统一通过 `MAXHUB_API_KEY` 认证,Base URL 为 `https://www.aconfig.cn`。
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
MAXHUB_API_KEY="your_api_key_here"
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
maxhub_auth_header="Authorization: Bearer ${MAXHUB_API_KEY}"
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
高
Generic API/secret keys
- **frontmatter.metadata.openclaw.primaryEnv**:统一为 `MAXHUB_API_KEY`
The snippet documents use of MAXHUB_API_KEY or an API key placeholder for Bearer authentication. No hardcoded secret is present, but the skill handles a sensitive user credential and sends it to MaxHub.
風險因素
🌐 網路存取 (106)
maxhub-lemon8/_meta.json:6 maxhub-lemon8/_meta.json:7 maxhub-lemon8/SKILL.md:18 maxhub-lemon8/SKILL.md:22 maxhub-lemon8/SKILL.md:30 maxhub-lemon8/SKILL.md:32 maxhub-lemon8/SKILL.md:45 maxhub-lemon8/SKILL.md:53 maxhub-lemon8/SKILL.md:57 maxhub-lemon8/SKILL.md:77 maxhub-lemon8/SKILL.md:88 maxhub-tiktok/_meta.json:6 maxhub-tiktok/_meta.json:7 maxhub-tiktok/references/api-ads-analytics.md:660 maxhub-tiktok/references/api-ads-analytics.md:662 maxhub-tiktok/references/api-ads-analytics.md:663 maxhub-tiktok/references/api-ads-analytics.md:664 maxhub-tiktok/references/api-ads-analytics.md:665 maxhub-tiktok/references/api-search.md:564 maxhub-tiktok/references/api-search.md:574 maxhub-tiktok/references/api-search.md:666 maxhub-tiktok/references/api-search.md:670 maxhub-tiktok/references/api-search.md:671 maxhub-tiktok/references/api-search.md:675 maxhub-tiktok/references/api-search.md:676 maxhub-tiktok/references/api-user.md:57 maxhub-tiktok/references/api-user.md:479 maxhub-tiktok/references/api-user.md:482 maxhub-tiktok/references/api-user.md:483 maxhub-tiktok/references/api-user.md:487 maxhub-tiktok/references/api-user.md:488 maxhub-tiktok/references/api-user.md:495 maxhub-tiktok/references/api-user.md:496 maxhub-tiktok/references/api-video.md:4305 maxhub-tiktok/references/api-video.md:4326 maxhub-tiktok/references/api-video.md:4328 maxhub-tiktok/references/api-video.md:4517 maxhub-tiktok/references/api-video.md:4521 maxhub-tiktok/references/api-video.md:4522 maxhub-tiktok/references/api-video.md:4526 maxhub-tiktok/references/api-video.md:4527 maxhub-tiktok/references/api-video.md:4665 maxhub-tiktok/references/api-video.md:4669 maxhub-tiktok/references/api-video.md:4970 maxhub-tiktok/references/api-video.md:4974 maxhub-tiktok/references/api-video.md:4980 maxhub-tiktok/references/api-video.md:4984 maxhub-tiktok/references/api-video.md:5319 maxhub-tiktok/references/api-video.md:5321 maxhub-tiktok/references/api-video.md:5322 maxhub-tiktok/references/api-video.md:5323 maxhub-tiktok/references/api-video.md:5324 maxhub-tiktok/references/api-video.md:5431 maxhub-tiktok/references/api-video.md:5437 maxhub-tiktok/references/api-video.md:5541 maxhub-tiktok/references/api-video.md:5542 maxhub-tiktok/references/api-video.md:5658 maxhub-tiktok/references/api-video.md:5662 maxhub-tiktok/references/api-video.md:5663 maxhub-tiktok/references/api-video.md:5672 maxhub-tiktok/references/api-video.md:5740 maxhub-tiktok/references/api-video.md:5742 maxhub-tiktok/references/api-video.md:5747 maxhub-tiktok/references/api-video.md:5749 maxhub-tiktok/SKILL.md:18 maxhub-tiktok/SKILL.md:22 maxhub-tiktok/SKILL.md:30 maxhub-tiktok/SKILL.md:32 maxhub-tiktok/SKILL.md:45 maxhub-tiktok/SKILL.md:53 maxhub-tiktok/SKILL.md:57 maxhub-tiktok/SKILL.md:75 maxhub-tiktok/SKILL.md:77 maxhub-tiktok/SKILL.md:98 maxhub-tiktok/SKILL.md:109 maxhub-toutiao/_meta.json:6 maxhub-toutiao/_meta.json:7 maxhub-toutiao/SKILL.md:18 maxhub-toutiao/SKILL.md:22 maxhub-toutiao/SKILL.md:30 maxhub-toutiao/SKILL.md:32 maxhub-toutiao/SKILL.md:45 maxhub-toutiao/SKILL.md:53 maxhub-toutiao/SKILL.md:57 maxhub-toutiao/SKILL.md:77 maxhub-toutiao/SKILL.md:88 maxhub-wechat/_meta.json:6 maxhub-wechat/_meta.json:7 maxhub-wechat/SKILL.md:18 maxhub-wechat/SKILL.md:22 maxhub-wechat/SKILL.md:30 maxhub-wechat/SKILL.md:32 maxhub-wechat/SKILL.md:45 maxhub-wechat/SKILL.md:53 maxhub-wechat/SKILL.md:57 maxhub-wechat/SKILL.md:77 maxhub-wechat/SKILL.md:88 README.md:47 README.md:196 RECOMMENDATION.md:151 SKILL.md:18 SKILL.md:22 SKILL.md:30 SKILL.md:34 SKILL.md:149 SKILL.md:153
🔑 環境變數 (67)
maxhub-lemon8/README_CN.md:22 maxhub-lemon8/README.md:22 maxhub-lemon8/references/api-post-user.md:4 maxhub-lemon8/references/api-search-discover.md:4 maxhub-lemon8/SKILL.md:10 maxhub-lemon8/SKILL.md:13 maxhub-lemon8/SKILL.md:17 maxhub-lemon8/SKILL.md:47 maxhub-lemon8/SKILL.md:50 maxhub-lemon8/SKILL.md:68 maxhub-lemon8/SKILL.md:80 maxhub-lemon8/SKILL.md:81 maxhub-lemon8/SKILL.md:91 maxhub-lemon8/SKILL.md:92 maxhub-tiktok/README_CN.md:26 maxhub-tiktok/README.md:26 maxhub-tiktok/references/api-ads-analytics.md:4 maxhub-tiktok/references/api-search.md:4 maxhub-tiktok/references/api-user.md:4 maxhub-tiktok/references/api-video.md:4 maxhub-tiktok/SKILL.md:10 maxhub-tiktok/SKILL.md:13 maxhub-tiktok/SKILL.md:17 maxhub-tiktok/SKILL.md:47 maxhub-tiktok/SKILL.md:50 maxhub-tiktok/SKILL.md:89 maxhub-tiktok/SKILL.md:101 maxhub-tiktok/SKILL.md:102 maxhub-tiktok/SKILL.md:112 maxhub-tiktok/SKILL.md:113 maxhub-toutiao/README_CN.md:20 maxhub-toutiao/README.md:20 maxhub-toutiao/references/api-content-user.md:4 maxhub-toutiao/SKILL.md:10 maxhub-toutiao/SKILL.md:13 maxhub-toutiao/SKILL.md:17 maxhub-toutiao/SKILL.md:47 maxhub-toutiao/SKILL.md:50 maxhub-toutiao/SKILL.md:68 maxhub-toutiao/SKILL.md:80 maxhub-toutiao/SKILL.md:81 maxhub-toutiao/SKILL.md:91 maxhub-toutiao/SKILL.md:92 maxhub-wechat/README_CN.md:21 maxhub-wechat/README.md:21 maxhub-wechat/references/api-channels.md:4 maxhub-wechat/references/api-mp.md:4 maxhub-wechat/SKILL.md:10 maxhub-wechat/SKILL.md:13 maxhub-wechat/SKILL.md:17 maxhub-wechat/SKILL.md:47 maxhub-wechat/SKILL.md:50 maxhub-wechat/SKILL.md:68 maxhub-wechat/SKILL.md:80 maxhub-wechat/SKILL.md:81 maxhub-wechat/SKILL.md:91 maxhub-wechat/SKILL.md:92 README.md:46 README.md:195 RECOMMENDATION.md:150 SKILL.md:10 SKILL.md:13 SKILL.md:17 SKILL.md:34 SKILL.md:146 SKILL.md:147 SKILL.md:199
⚙️ 外部命令 (107)
maxhub-lemon8/SKILL.md:45 maxhub-lemon8/SKILL.md:47 maxhub-lemon8/SKILL.md:49-61 maxhub-lemon8/SKILL.md:61-67 maxhub-lemon8/SKILL.md:67-69 maxhub-lemon8/SKILL.md:69-80 maxhub-lemon8/SKILL.md:80-81 maxhub-lemon8/SKILL.md:81-91 maxhub-lemon8/SKILL.md:91-92 maxhub-lemon8/SKILL.md:92-106 maxhub-lemon8/SKILL.md:106-107 maxhub-lemon8/SKILL.md:107-108 maxhub-lemon8/SKILL.md:108-160 maxhub-tiktok/SKILL.md:45 maxhub-tiktok/SKILL.md:47 maxhub-tiktok/SKILL.md:49-61 maxhub-tiktok/SKILL.md:61-75 maxhub-tiktok/SKILL.md:75-77 maxhub-tiktok/SKILL.md:77-88 maxhub-tiktok/SKILL.md:88-90 maxhub-tiktok/SKILL.md:90-101 maxhub-tiktok/SKILL.md:101-102 maxhub-tiktok/SKILL.md:102-112 maxhub-tiktok/SKILL.md:112-113 maxhub-tiktok/SKILL.md:113-127 maxhub-tiktok/SKILL.md:127-128 maxhub-tiktok/SKILL.md:128-129 maxhub-tiktok/SKILL.md:129-130 maxhub-tiktok/SKILL.md:130-131 maxhub-tiktok/SKILL.md:131-132 maxhub-tiktok/SKILL.md:132-133 maxhub-tiktok/SKILL.md:133-192 maxhub-toutiao/SKILL.md:45 maxhub-toutiao/SKILL.md:47 maxhub-toutiao/SKILL.md:49-61 maxhub-toutiao/SKILL.md:61-67 maxhub-toutiao/SKILL.md:67-69 maxhub-toutiao/SKILL.md:69-80 maxhub-toutiao/SKILL.md:80-81 maxhub-toutiao/SKILL.md:81-91 maxhub-toutiao/SKILL.md:91-92 maxhub-toutiao/SKILL.md:92-106 maxhub-toutiao/SKILL.md:106-154 maxhub-wechat/SKILL.md:45 maxhub-wechat/SKILL.md:47 maxhub-wechat/SKILL.md:49-61 maxhub-wechat/SKILL.md:61-67 maxhub-wechat/SKILL.md:67-69 maxhub-wechat/SKILL.md:69-80 maxhub-wechat/SKILL.md:80-81 maxhub-wechat/SKILL.md:81-91 maxhub-wechat/SKILL.md:91-92 maxhub-wechat/SKILL.md:92-106 maxhub-wechat/SKILL.md:106-107 maxhub-wechat/SKILL.md:107-165 SKILL.md:34 SKILL.md:67 SKILL.md:68 SKILL.md:69 SKILL.md:70 SKILL.md:71 SKILL.md:72 SKILL.md:73 SKILL.md:79 SKILL.md:80 SKILL.md:81 SKILL.md:82 SKILL.md:83 SKILL.md:84 SKILL.md:85 SKILL.md:86 SKILL.md:87 SKILL.md:88 SKILL.md:94 SKILL.md:95 SKILL.md:96 SKILL.md:100-139 SKILL.md:139-145 SKILL.md:145-151 SKILL.md:151-161 SKILL.md:161-162 SKILL.md:162-163 SKILL.md:163-164 SKILL.md:164-165 SKILL.md:165-166 SKILL.md:166-167 SKILL.md:167-173 SKILL.md:173-174 SKILL.md:174-175 SKILL.md:175-176 SKILL.md:176-177 SKILL.md:177-178 SKILL.md:178-179 SKILL.md:179-180 SKILL.md:180-181 SKILL.md:181-182 SKILL.md:182-183 SKILL.md:183-189 SKILL.md:189-190 SKILL.md:190-191 SKILL.md:191-192 SKILL.md:192 SKILL.md:193-197 SKILL.md:197-199 SKILL.md:199-201 SKILL.md:201-205 SKILL.md:205-211
審計單位: codex 檢視審計紀錄 →
分享與引用此報告
分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。
複製報告連結
https://skillstore.io/skills/xiewxx-maxhub-skills/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/xiewxx-maxhub-skills?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/xiewxx-maxhub-skills?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/xiewxx-maxhub-skills/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/xiewxx-maxhub-skills.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>學術引用 (APA · BibTeX · CFF)
APA 引用
XieWxx. (2026). maxhub-skills security audit report (audit version 4) [Author version 3.2.0]. Skillstore. https://skillstore.io/skills/xiewxx-maxhub-skills/audits/4BibTeX 引用
@techreport{xiewxx-xiewxx-maxhub-skills-2026,
author = {XieWxx},
title = {maxhub-skills security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/xiewxx-maxhub-skills/audits/4},
note = {Author version 3.2.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "maxhub-skills security audit report (audit version 4)"
version: "3.2.0"
type: report
authors:
- name: "XieWxx"
date-released: "2026-07-08"
url: "https://skillstore.io/skills/xiewxx-maxhub-skills/audits/4"
identifiers:
- type: other
value: "skillstore:xiewxx-maxhub-skills:audit:4"
description: "Skillstore immutable audit report identifier"
Skillstore 評分
評分依據 證據置信度: 中 55
架構
100
可維護性
87
內容
68
社群
100
規範符合度
你可以打造什麼
比較平台趨勢資料
在建立報告之前，找出哪些 endpoint 群組可擷取 TikTok、Lemon8、Toutiao 或 WeChat 上的熱門內容。
準備內容分析查詢
識別計畫中的內容成效檢視所需的 video、user、search 和 comment endpoints。
整合前檢視 API 涵蓋範圍
在實作 MaxHub API calls 前，檢查支援的 endpoints、必要參數與 authentication 規則。
試試這些提示
尋找基本 Endpoint
Use maxhub-skills to find which MaxHub endpoint group can search TikTok videos for a keyword. Explain the required API key setup and main parameters.
規劃使用者研究查詢
Use maxhub-skills to plan a Lemon8 user research workflow. Include the endpoint categories, required identifiers, and safe limits for pagination.
比較平台選項
Use maxhub-skills to compare the available TikTok, Toutiao, and WeChat data query options for tracking public content trends.
稽核整合計畫
Use maxhub-skills to review my planned MaxHub integration for credential handling, endpoint selection, rate limits, and high-risk capabilities to avoid.
最佳實務
- 使用有範圍限制的測試憑證，並在評估後輪換。
- 優先使用 read-only public data endpoints，並避免 cookie-based workflows。
- 執行前檢視 endpoint 用途，特別是 TikTok tools 和 interaction actions。
避免
- 請勿使用此 skill 產生平台 anti-bot signatures 或繞過 protections。
- 除非有正式的 data-processing agreement，否則請勿傳送完整 browser cookies。
- 請勿自動化 likes、follows、comments、private messages 或 metric manipulation。
常見問題
此 skill 會直接呼叫 MaxHub API 嗎？
它記錄如何呼叫 MaxHub APIs，並包含 curl 範例。Runtime behavior 取決於 host tool 和 user permissions。
是否需要 API key？
是。文件需要 MAXHUB_API_KEY，並將其作為 bearer token 傳送至 MaxHub service。
它可以查詢多個平台嗎？
可以。此 shard 包含 TikTok、Lemon8、Toutiao 和 WeChat skills，而 root documentation 則參照更大的 MaxHub collection。
現在發布安全嗎？
不可以。稽核發現高風險的 bypass、manipulation、credential 和 protected-media decryption guidance。
為什麼會回報 command findings？
大多數 command findings 是 curl、environment variables 或 installation 的 Markdown 範例。當使用者以真實 credentials 執行它們時，仍然具有敏感性。
發布前應移除哪些內容？
發布前應移除 anti-bot signature helpers、metric manipulation endpoints、interaction automation、private-message helpers 和 protected-media decryption guidance。
開發者詳細資訊
作者
XieWxx授權
MIT-0
作者版本
v3.2.0
Skillstore 修訂
r1
引用
64ca8af0f54a325752f08bd54e52151061ea659a
維護新鮮度
2026/7/21
使用量
3 次下載 · 73 次瀏覽
XieWxx 的更多技能
查看全部📦
maxhub-hybrid
77使用 MaxHub 解析混合影片資料
團隊經常需要從公開影片連結取得結構化資料，而不想建置自訂解析器。此技能會引導 Claude、Codex 和 Claude Code 呼叫 MaxHub HybridParser API，並提供清楚的限制與憑證處理方式。
資料與分析 查看
📦
maxhub-lemon8
73使用 MaxHub Data 分析 Lemon8 內容
Lemon8 研究通常需要多次搜尋、檢查個人檔案，以及查詢貼文。此技能會引導 Claude、Codex 和 Claude Code 透過 MaxHub APIs 進行結構化的 Lemon8 分析。
研究與學習 查看
📦
maxhub-tiktok
38使用 MaxHub API 分析 TikTok 資料
TikTok 研究通常需要使用許多不同端點，並仔細選擇參數。此技能會路由請求，並為影片、使用者、搜尋、廣告與商店分析格式化結果。
資料與分析 查看
📦
maxhub-wechat
38使用 MaxHub 分析 WeChat 資料
WeChat 研究通常需要使用多個端點並謹慎處理分頁。此技能會引導 Claude、Codex 和 Claude Code 透過 MaxHub 查詢並進行結構化分析。
資料與分析 查看
相關技能
查看全部📦
senior-data-scientist
81設計資料科學實驗與模型
由 alirezarezvani
當實驗、特徵和模型缺乏清楚的統計結構時，資料科學專案往往會失敗。這項技能為 Claude、Codex 和 Claude Code 提供實驗設計、特徵工程和模型審查的引導式工作流程。
資料與分析 查看
📦
data-storytelling
79建立清晰的資料故事
由 wshobson
原始指標通常難以說服利害關係人或支援決策。這項技能可協助 Claude、Codex 和 Claude Code 將分析整理成清晰的敘事、視覺化內容與建議。
資料與分析 查看
📦
business-analyst
79透過 BI 指引分析業務績效
由 sickn33
團隊經常難以將指標、儀表板和研究轉化為清楚的商業決策。此技能為 Claude、Codex 和 Claude Code 建構分析、KPI 設計、預測和建議。
資料與分析 查看
📦
sql-queries-tool
79為 DBX Studio 產生 SQL 查詢
由 Dbxstudio
資料庫使用者需要可靠的 SQL，且必須符合其連線類型與結構描述。此技能會引導 Claude、Codex 和 Claude Code 檢查結構描述、撰寫唯讀查詢，並清楚說明結果。
資料與分析 查看
📦
data-orchestrator
79協調資料管線與品質檢查
由 Brownbull
當擷取、特徵、品質與報告各自分開規劃時，資料管線工作可能變得不一致。此技能會圍繞管線脈絡、品質關卡、資料 lineage 與交接來組織資料任務。
資料與分析 查看
📦
pangolinfo-amazon-scraper
79Scrape Amazon Data with Pangolinfo
由 pangolin-spg
Manual Amazon research is slow and difficult to standardize across products, sellers, and search results. This skill retrieves structured marketplace data through Pangolinfo parsers for repeatable analysis workflows.
資料與分析 查看