▶️
審計歷史
maxhub-youtube - 2 審計
審計版本 2
最新 低風險May 20, 2026, 01:22 PM
All 815 static findings are false positives from Markdown documentation formatting. The skill is a legitimate YouTube API client that uses curl commands with a MAXHUB_API_KEY to query the MaxHub API service at aconfig.cn. No malicious code, obfuscated payloads, or unauthorized data exfiltration was detected.
8
已掃描檔案
2,599
分析行數
10
發現項
claude
審計者
低風險問題 (7)
Markdown backtick formatting misidentified as shell execution
586 static findings for Ruby/shell backtick execution are all FALSE POSITIVES. The scanner misidentified Markdown inline code formatting (backtick pairs for code highlighting) as Ruby shell command execution. Example: `https://www.aconfig.cn` is Markdown-formatted URL text, not a shell command. No actual Ruby backtick execution exists in this skill.
Weak cryptographic algorithm detection is markdown table formatting
All 'Weak cryptographic algorithm' findings are FALSE POSITIVES. The scanner detected pipe characters `|` in Markdown tables and MD references in API parameter docs as cryptographic algorithm signatures. These are parameter documentation tables (e.g., `| Parameter | Type | Required |`) not crypto code.
Base64 continuation token misidentified as C2 payload
The 'C2 keywords' finding at api-video.md:934 is a FALSE POSITIVE. The base64-encoded string is a YouTube continuation token for comment reply pagination (reply_continuation_token). It is a legitimate API pagination parameter, not a C2 communication payload.
High file entropy from Chinese text and base64 tokens
Heuristic entropy findings for files with Chinese characters and base64 API tokens are FALSE POSITIVES. SKILL.md contains Chinese/English bilingual content which has higher entropy than plain English. api-channel.md and api-video.md contain base64-encoded continuation tokens which raise file entropy.
System reconnaissance on public YouTube channel IDs
Static findings for 'System reconnaissance' are FALSE POSITIVES. The detected strings are example YouTube channel IDs (e.g., UCkRfArvrzheW2E7b6SVT7vQ) used in API documentation examples. These are publicly available channel identifiers, not system reconnaissance.
Expected network calls to MaxHub API service
65 network findings for hardcoded URLs to aconfig.cn are TRUE POSITIVES but expected behavior. The skill calls the MaxHub API (www.aconfig.cn) to fetch YouTube data. All URLs point to a single, legitimate third-party API service with documented endpoints.
Environment variable access for API authentication
17 env_access findings for MAXHUB_API_KEY are TRUE POSITIVES but expected. The skill requires a MAXHUB_API_KEY environment variable for Bearer token authentication. This is standard API client behavior, clearly documented as required.
風險因素
🌐 網路存取 (65)
_meta.json:6 _meta.json:7 README_CN.md:22 README_CN.md:38 README_CN.md:42 README.md:22 README.md:38 README.md:42 references/api-channel.md:3 references/api-channel.md:37 references/api-channel.md:110 references/api-channel.md:141 references/api-channel.md:161 references/api-channel.md:162 references/api-channel.md:163 references/api-channel.md:184 references/api-channel.md:185 references/api-channel.md:237 references/api-channel.md:265 references/api-channel.md:425 references/api-search.md:3 references/api-video.md:3 references/api-video.md:70 references/api-video.md:148 references/api-video.md:177 references/api-video.md:182 references/api-video.md:191 references/api-video.md:192 references/api-video.md:359 references/api-video.md:410 references/api-video.md:426 references/api-video.md:740 references/api-video.md:805 references/api-video.md:873 references/api-video.md:969 references/api-video.md:970 references/api-video.md:1016 references/api-video.md:1060 references/api-video.md:1061 references/api-video.md:1069 references/api-video.md:1160 references/api-video.md:1229 references/api-video.md:1244 references/api-video.md:1292 references/api-video.md:1340 references/param-mappings.md:3 references/param-mappings.md:29 references/param-mappings.md:33 references/param-mappings.md:47 references/param-mappings.md:128 references/param-mappings.md:158 references/param-mappings.md:170 references/param-mappings.md:177 references/param-mappings.md:220 references/param-mappings.md:225 references/param-mappings.md:229 SKILL.md:18 SKILL.md:22 SKILL.md:30 SKILL.md:32 SKILL.md:45 SKILL.md:53 SKILL.md:57 SKILL.md:77 SKILL.md:88
⚙️ 外部命令 (586)
README_CN.md:16-18 README_CN.md:18-23 README_CN.md:23 README.md:16-18 README.md:18-23 README.md:23 references/api-channel.md:3 references/api-channel.md:4 references/api-channel.md:9 references/api-channel.md:25 references/api-channel.md:37 references/api-channel.md:38 references/api-channel.md:42 references/api-channel.md:45 references/api-channel.md:51 references/api-channel.md:84 references/api-channel.md:100 references/api-channel.md:110 references/api-channel.md:112 references/api-channel.md:117 references/api-channel.md:118 references/api-channel.md:122 references/api-channel.md:123 references/api-channel.md:123 references/api-channel.md:127 references/api-channel.md:128 references/api-channel.md:128 references/api-channel.md:128 references/api-channel.md:128 references/api-channel.md:131 references/api-channel.md:132 references/api-channel.md:132 references/api-channel.md:132 references/api-channel.md:135 references/api-channel.md:137 references/api-channel.md:138 references/api-channel.md:141 references/api-channel.md:142 references/api-channel.md:142 references/api-channel.md:143 references/api-channel.md:146-170 references/api-channel.md:170-172 references/api-channel.md:172-193 references/api-channel.md:193-199 references/api-channel.md:199-204 references/api-channel.md:204-216 references/api-channel.md:216-229 references/api-channel.md:229-241 references/api-channel.md:241-257 references/api-channel.md:257-269 references/api-channel.md:269-285 references/api-channel.md:285-297 references/api-channel.md:297-318 references/api-channel.md:318-330 references/api-channel.md:330-351 references/api-channel.md:351-366 references/api-channel.md:366-376 references/api-channel.md:376-378 references/api-channel.md:378-379 references/api-channel.md:379-380 references/api-channel.md:380-382 references/api-channel.md:382-383 references/api-channel.md:383-385 references/api-channel.md:385-397 references/api-channel.md:397-413 references/api-channel.md:413-425 references/api-channel.md:425-426 references/api-channel.md:426-430 references/api-channel.md:430 references/api-channel.md:430-431 references/api-channel.md:431-433 references/api-channel.md:433-434 references/api-channel.md:434-435 references/api-channel.md:435-463 references/api-channel.md:463-478 references/api-channel.md:478-498 references/api-channel.md:498-514 references/api-channel.md:514-530 references/api-channel.md:530-544 references/api-search.md:3 references/api-search.md:4 references/api-search.md:9 references/api-search.md:27 references/api-video.md:3 references/api-video.md:4 references/api-video.md:9 references/api-video.md:21 references/api-video.md:34 references/api-video.md:47 references/api-video.md:61 references/api-video.md:76 references/api-video.md:120 references/api-video.md:136 references/api-video.md:148 references/api-video.md:149 references/api-video.md:150 references/api-video.md:154 references/api-video.md:155 references/api-video.md:155 references/api-video.md:155 references/api-video.md:155 references/api-video.md:158 references/api-video.md:159 references/api-video.md:159 references/api-video.md:159 references/api-video.md:163 references/api-video.md:166 references/api-video.md:168 references/api-video.md:169 references/api-video.md:171-197 references/api-video.md:197-199 references/api-video.md:199-200 references/api-video.md:200-201 references/api-video.md:201-202 references/api-video.md:202-203 references/api-video.md:203-204 references/api-video.md:204-205 references/api-video.md:205-206 references/api-video.md:206-207 references/api-video.md:207-208 references/api-video.md:208-209 references/api-video.md:209-210 references/api-video.md:210-211 references/api-video.md:211-212 references/api-video.md:212-213 references/api-video.md:213-214 references/api-video.md:214-218 references/api-video.md:218-234 references/api-video.md:234-241 references/api-video.md:241-242 references/api-video.md:242 references/api-video.md:242-243 references/api-video.md:243 references/api-video.md:243 references/api-video.md:243 references/api-video.md:243-247 references/api-video.md:247 references/api-video.md:247 references/api-video.md:247 references/api-video.md:247-259 references/api-video.md:259-280 references/api-video.md:280-286 references/api-video.md:286-296 references/api-video.md:296-297 references/api-video.md:297-298 references/api-video.md:298-299 references/api-video.md:299-300 references/api-video.md:300-302 references/api-video.md:302-303 references/api-video.md:303-304 references/api-video.md:304-306 references/api-video.md:306-307 references/api-video.md:307-308 references/api-video.md:308-309 references/api-video.md:309-311 references/api-video.md:311-312 references/api-video.md:312-313 references/api-video.md:313-314 references/api-video.md:314-315 references/api-video.md:315-316 references/api-video.md:316-317 references/api-video.md:317-318 references/api-video.md:318-319 references/api-video.md:319-320 references/api-video.md:320-321 references/api-video.md:321-323 references/api-video.md:323-324 references/api-video.md:324-325 references/api-video.md:325-326 references/api-video.md:326-332 references/api-video.md:332-347 references/api-video.md:347-359 references/api-video.md:359-360 references/api-video.md:360-362 references/api-video.md:362-363 references/api-video.md:363-364 references/api-video.md:364-389 references/api-video.md:389-402 references/api-video.md:402-417 references/api-video.md:417-431 references/api-video.md:431-477 references/api-video.md:477-491 references/api-video.md:491-522 references/api-video.md:522-541 references/api-video.md:541-547 references/api-video.md:547-561 references/api-video.md:561-563 references/api-video.md:563-569 references/api-video.md:569 references/api-video.md:569 references/api-video.md:569-574 references/api-video.md:574-576 references/api-video.md:576-577 references/api-video.md:577-578 references/api-video.md:578-579 references/api-video.md:579-580 references/api-video.md:580-581 references/api-video.md:581-582 references/api-video.md:582-583 references/api-video.md:583-584 references/api-video.md:584-586 references/api-video.md:586-590 references/api-video.md:590-592 references/api-video.md:592-593 references/api-video.md:593-594 references/api-video.md:594-595 references/api-video.md:595-596 references/api-video.md:596-597 references/api-video.md:597-598 references/api-video.md:598-599 references/api-video.md:599-601 references/api-video.md:601-605 references/api-video.md:605-607 references/api-video.md:607-608 references/api-video.md:608-609 references/api-video.md:609-610 references/api-video.md:610-611 references/api-video.md:611-612 references/api-video.md:612-613 references/api-video.md:613-617 references/api-video.md:617-619 references/api-video.md:619-620 references/api-video.md:620-621 references/api-video.md:621-623 references/api-video.md:623-624 references/api-video.md:624-629 references/api-video.md:629-631 references/api-video.md:631-632 references/api-video.md:632-633 references/api-video.md:633-634 references/api-video.md:634-635 references/api-video.md:635-636 references/api-video.md:636-641 references/api-video.md:641-643 references/api-video.md:643-644 references/api-video.md:644-645 references/api-video.md:645-646 references/api-video.md:646-647 references/api-video.md:647-649 references/api-video.md:649-650 references/api-video.md:650-651 references/api-video.md:651-652 references/api-video.md:652-657 references/api-video.md:657-659 references/api-video.md:659-671 references/api-video.md:671-676 references/api-video.md:676-679 references/api-video.md:679-681 references/api-video.md:681-684 references/api-video.md:684-686 references/api-video.md:686-688 references/api-video.md:688-725 references/api-video.md:725-731 references/api-video.md:731-745 references/api-video.md:745-767 references/api-video.md:767-781 references/api-video.md:781-796 references/api-video.md:796-811 references/api-video.md:811-832 references/api-video.md:832-851 references/api-video.md:851-864 references/api-video.md:864-879 references/api-video.md:879-885 references/api-video.md:885-903 references/api-video.md:903-907 references/api-video.md:907-922 references/api-video.md:922-932 references/api-video.md:932-934 references/api-video.md:934-938 references/api-video.md:938-939 references/api-video.md:939 references/api-video.md:939 references/api-video.md:939 references/api-video.md:939-942 references/api-video.md:942-943 references/api-video.md:943 references/api-video.md:943 references/api-video.md:943-946 references/api-video.md:946-948 references/api-video.md:948-949 references/api-video.md:949-951 references/api-video.md:951-952 references/api-video.md:952-955 references/api-video.md:955-979 references/api-video.md:979-981 references/api-video.md:981-982 references/api-video.md:982-987 references/api-video.md:987-1004 references/api-video.md:1004-1015 references/api-video.md:1015-1016 references/api-video.md:1016-1020 references/api-video.md:1020-1021 references/api-video.md:1021 references/api-video.md:1021 references/api-video.md:1021 references/api-video.md:1021-1024 references/api-video.md:1024-1025 references/api-video.md:1025 references/api-video.md:1025 references/api-video.md:1025-1028 references/api-video.md:1028-1030 references/api-video.md:1030-1031 references/api-video.md:1031-1034 references/api-video.md:1034-1038 references/api-video.md:1038-1040 references/api-video.md:1040-1041 references/api-video.md:1041-1043 references/api-video.md:1043-1074 references/api-video.md:1074-1076 references/api-video.md:1076-1077 references/api-video.md:1077-1078 references/api-video.md:1078-1079 references/api-video.md:1079-1080 references/api-video.md:1080-1081 references/api-video.md:1081-1082 references/api-video.md:1082-1083 references/api-video.md:1083-1084 references/api-video.md:1084-1085 references/api-video.md:1085-1086 references/api-video.md:1086-1087 references/api-video.md:1087-1088 references/api-video.md:1088-1089 references/api-video.md:1089-1090 references/api-video.md:1090-1091 references/api-video.md:1091-1092 references/api-video.md:1092-1096 references/api-video.md:1096-1114 references/api-video.md:1114-1134 references/api-video.md:1134-1148 references/api-video.md:1148-1160 references/api-video.md:1160 references/api-video.md:1160-1161 references/api-video.md:1161-1165 references/api-video.md:1165-1166 references/api-video.md:1166 references/api-video.md:1166 references/api-video.md:1166 references/api-video.md:1166-1168 references/api-video.md:1168-1197 references/api-video.md:1197-1199 references/api-video.md:1199-1200 references/api-video.md:1200-1201 references/api-video.md:1201-1202 references/api-video.md:1202-1203 references/api-video.md:1203-1204 references/api-video.md:1204-1205 references/api-video.md:1205-1209 references/api-video.md:1209-1221 references/api-video.md:1221-1235 references/api-video.md:1235-1248 references/api-video.md:1248-1283 references/api-video.md:1283-1296 references/api-video.md:1296-1332 references/api-video.md:1332-1347 references/api-video.md:1347-1361 references/api-video.md:1361-1377 references/param-mappings.md:3 references/param-mappings.md:3 references/param-mappings.md:9 references/param-mappings.md:9 references/param-mappings.md:10 references/param-mappings.md:10 references/param-mappings.md:11 references/param-mappings.md:11 references/param-mappings.md:12 references/param-mappings.md:13 references/param-mappings.md:17 references/param-mappings.md:17 references/param-mappings.md:18 references/param-mappings.md:19 references/param-mappings.md:19 references/param-mappings.md:20 references/param-mappings.md:20 references/param-mappings.md:21 references/param-mappings.md:25 references/param-mappings.md:25 references/param-mappings.md:29 references/param-mappings.md:29 references/param-mappings.md:33 references/param-mappings.md:33 references/param-mappings.md:37 references/param-mappings.md:37 references/param-mappings.md:41 references/param-mappings.md:41 references/param-mappings.md:42 references/param-mappings.md:46 references/param-mappings.md:46 references/param-mappings.md:47 references/param-mappings.md:47 references/param-mappings.md:48 references/param-mappings.md:49 references/param-mappings.md:53 references/param-mappings.md:53 references/param-mappings.md:57 references/param-mappings.md:57 references/param-mappings.md:61 references/param-mappings.md:61 references/param-mappings.md:62 references/param-mappings.md:62 references/param-mappings.md:63 references/param-mappings.md:63 references/param-mappings.md:64 references/param-mappings.md:65 references/param-mappings.md:69 references/param-mappings.md:69 references/param-mappings.md:70 references/param-mappings.md:70 references/param-mappings.md:71 references/param-mappings.md:71 references/param-mappings.md:72 references/param-mappings.md:72 references/param-mappings.md:73 references/param-mappings.md:77 references/param-mappings.md:77 references/param-mappings.md:78 references/param-mappings.md:79 references/param-mappings.md:80 references/param-mappings.md:81 references/param-mappings.md:82 references/param-mappings.md:83 references/param-mappings.md:84 references/param-mappings.md:85 references/param-mappings.md:86 references/param-mappings.md:90 references/param-mappings.md:90 references/param-mappings.md:91 references/param-mappings.md:92 references/param-mappings.md:93 references/param-mappings.md:94 references/param-mappings.md:95 references/param-mappings.md:96 references/param-mappings.md:100 references/param-mappings.md:101 references/param-mappings.md:101 references/param-mappings.md:102 references/param-mappings.md:102 references/param-mappings.md:103 references/param-mappings.md:107 references/param-mappings.md:107 references/param-mappings.md:108 references/param-mappings.md:109 references/param-mappings.md:109 references/param-mappings.md:110 references/param-mappings.md:110 references/param-mappings.md:111 references/param-mappings.md:115 references/param-mappings.md:115 references/param-mappings.md:116 references/param-mappings.md:116 references/param-mappings.md:117 references/param-mappings.md:117 references/param-mappings.md:118 references/param-mappings.md:122 references/param-mappings.md:122 references/param-mappings.md:123 references/param-mappings.md:127 references/param-mappings.md:127 references/param-mappings.md:128 references/param-mappings.md:128 references/param-mappings.md:129 references/param-mappings.md:133 references/param-mappings.md:133 references/param-mappings.md:134 references/param-mappings.md:134 references/param-mappings.md:135 references/param-mappings.md:135 references/param-mappings.md:139 references/param-mappings.md:139 references/param-mappings.md:140 references/param-mappings.md:140 references/param-mappings.md:141 references/param-mappings.md:141 references/param-mappings.md:142 references/param-mappings.md:142 references/param-mappings.md:143 references/param-mappings.md:144 references/param-mappings.md:145 references/param-mappings.md:146 references/param-mappings.md:146 references/param-mappings.md:150 references/param-mappings.md:150 references/param-mappings.md:151 references/param-mappings.md:152 references/param-mappings.md:153 references/param-mappings.md:157 references/param-mappings.md:157 references/param-mappings.md:158 references/param-mappings.md:158 references/param-mappings.md:159 references/param-mappings.md:159 references/param-mappings.md:163 references/param-mappings.md:164 references/param-mappings.md:165 references/param-mappings.md:169 references/param-mappings.md:169 references/param-mappings.md:170 references/param-mappings.md:170 references/param-mappings.md:171 references/param-mappings.md:171 references/param-mappings.md:172 references/param-mappings.md:172 references/param-mappings.md:176 references/param-mappings.md:176 references/param-mappings.md:177 references/param-mappings.md:177 references/param-mappings.md:178 references/param-mappings.md:178 references/param-mappings.md:179 references/param-mappings.md:179 references/param-mappings.md:183 references/param-mappings.md:184 references/param-mappings.md:184 references/param-mappings.md:185 references/param-mappings.md:185 references/param-mappings.md:186 references/param-mappings.md:190 references/param-mappings.md:190 references/param-mappings.md:191 references/param-mappings.md:191 references/param-mappings.md:192 references/param-mappings.md:192 references/param-mappings.md:193 references/param-mappings.md:194 references/param-mappings.md:195 references/param-mappings.md:199 references/param-mappings.md:199 references/param-mappings.md:200 references/param-mappings.md:201 references/param-mappings.md:201 references/param-mappings.md:202 references/param-mappings.md:203 references/param-mappings.md:204 references/param-mappings.md:205 references/param-mappings.md:209 references/param-mappings.md:209 references/param-mappings.md:210 references/param-mappings.md:210 references/param-mappings.md:211 references/param-mappings.md:215 references/param-mappings.md:215 references/param-mappings.md:219 references/param-mappings.md:219 references/param-mappings.md:220 references/param-mappings.md:220 references/param-mappings.md:224 references/param-mappings.md:224 references/param-mappings.md:225 references/param-mappings.md:225 references/param-mappings.md:229 references/param-mappings.md:229 references/param-mappings.md:230 references/param-mappings.md:231 references/param-mappings.md:232 references/param-mappings.md:232 references/param-mappings.md:236 references/param-mappings.md:236 references/param-mappings.md:237 references/param-mappings.md:237 references/param-mappings.md:238 references/param-mappings.md:239 references/param-mappings.md:240 references/param-mappings.md:244 references/param-mappings.md:244 references/param-mappings.md:245 references/param-mappings.md:246 references/param-mappings.md:250 references/param-mappings.md:250 references/param-mappings.md:251 references/param-mappings.md:252 references/param-mappings.md:253 references/param-mappings.md:254 SKILL.md:45 SKILL.md:47 SKILL.md:47 SKILL.md:49-61 SKILL.md:61-67 SKILL.md:67-69 SKILL.md:69-80 SKILL.md:80-81 SKILL.md:81-91 SKILL.md:91-92 SKILL.md:92-106 SKILL.md:106-107 SKILL.md:107-108 SKILL.md:108-109 SKILL.md:109-167
偵測到的模式
Shell command execution via curl for API callsCombined network + command execution + credential access
審計版本 1
低風險May 9, 2026, 07:52 AM
Evaluated 168 static findings across 3 files (439 lines). All 117 'external_commands' flags are false positives from markdown code blocks showing curl examples. Network and env_access flags are acceptable API integration patterns. No prompt injection detected. This is a legitimate YouTube data integration skill using MaxHub API proxy.
3
已掃描檔案
439
分析行數
7
發現項
claude
審計者
高風險問題 (3)
references/api-catalog.md:9-35references/api-catalog.md:41-67references/chain-patterns.md:8-35SKILL.md:42-304
Static Scanner Pattern False Positives - External Commands
117 'Ruby/shell backtick execution' flags are false positives. The scanner detected backtick syntax in markdown code blocks (```) as shell execution, but these are simply curl command examples in documentation showing API call syntax. No actual shell execution occurs.
Static Scanner Pattern False Positives - Weak Cryptographic Algorithm
HIGH flags for 'weak cryptographic algorithm' are false positives. These are triggered by API path names containing 'get_signed_stream_url' and similar terms. No actual cryptographic code exists in the markdown files.
High Entropy Strings Are Normal Documentation Content
Heuristic flags for high entropy (6.53 bits, 6.31 bits) are false positives. The entropy comes from markdown formatting, mixed Chinese/English content, and API response structure examples - not encrypted or obfuscated payloads.
低風險問題 (2)
System Reconnaissance Flags Are Documentation Text
LOW flags for 'system reconnaissance' at lines 308-311 of SKILL.md are false positives. These are standard API documentation mentions of request headers and rate limits, not system exploration commands.
Hardcoded URLs Are Legitimate Service Endpoints
5 'Hardcoded URL' flags for aconfig.cn and gitee.com domains are acceptable. These are the documented MaxHub API proxy service endpoints, not malicious destinations.