Skills/ClawHub/huawei-cloud-daily-hot-topics

huawei-cloud-daily-hot-topics@1.0.4

CAUTION

Publisher claims: "Query and display today's hot topics in one shot: fetch a ranked hot list (rank / title / hot value / source) from public, authentication-free hot-list REST APIs over HTTPS (read-only), normalise the results and print them as a readable Markdown table by default (plain text and JSON are also available). Providers are abstracted and tried in order, degrading to a bundled sample dataset — clearly marked as sample data — when the network or every provider is unavailable, so a single run always yields a readable result without crashing. Implemented with the Python 3 standard library only; it does not call the Huawei Cloud CLI, any Huawei Cloud SDK, or any Huawei Cloud REST API, requires no AK/SK credentials, and touches no cloud resource. Triggers include: "查询今日热点", "今日热点榜单", "热门话题", "今日热搜", "热点榜", "daily hot topics", "today hot list", "trending topics"." Observed in sandbox: static analysis only — behavior not yet observed.

Registry ClawHubPublisher wlc-dev · joined 14 days agoInstalls 212Last detonated 2 h ago
What would fix thisWatchDispute verdict

Is [email protected] safe to install?

KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-05 and scored it 67/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Summary: static analysis only — behavior not yet observed.

Behavior trace

Queued for honeypot run · static analysis only
t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

MEDIUM
Dense URL-encoded contentscripts/sample_data.json:8 · Dense URL-encoded content — may be obfuscating payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Dense URL-encoded contentscripts/sample_data.json:10 · Dense URL-encoded content — may be obfuscating payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Dense URL-encoded contentscripts/sample_data.json:6 · Dense URL-encoded content — may be obfuscating payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Dense URL-encoded contentscripts/sample_data.json:9 · Dense URL-encoded content — may be obfuscating payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Dense URL-encoded contentscripts/sample_data.json:7 · Dense URL-encoded content — may be obfuscating payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07

Cost to the agent

Instructions loaded
≈1,720 tok
1 file · 11 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

13 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim wlc-dev: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Dense URL-encoded content≈ +2 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim wlc-dev