Zhihu Hot CN

知乎热榜监控 - 获取知乎热门话题、问题和趋势分析（Quora 中国版）

This skill is lightweight and fetches public hot-list data from a GitHub README, so it is not requesting secrets or installing code. However: (1) the documentation references additional scripts (compare-trends.sh, find-persistent.sh) and data sources that are not included — the package appears incomplete; (2) the script parses raw README content and will execute curl to raw.githubusercontent.com at runtime, so verify that the remote README content is what you expect before running; (3) the shell script has some parsing logic that can produce malformed JSON if the source format changes (a functional bug, not secret exfiltration). Recommendation: inspect the remote README URL manually (curl the DATA_URL) and test the script in a sandbox or isolated environment. If you need the advertised trend/compare features, ask the publisher for the missing scripts or an updated release.

Type: OpenClaw Skill Name: zhihu-hot-cn Version: 1.0.0 The skill is classified as suspicious due to its reliance on fetching data from an external, untrusted source (raw.githubusercontent.com) via `curl` in `scripts/get-hot.sh`. While this network access is necessary for the skill's stated purpose of retrieving Zhihu hot topics, any external network call represents a potential risk, especially when parsing a remote `README.md` file, which could change format unexpectedly. There is no clear evidence of intentional malicious behavior such as data exfiltration, persistence, or direct prompt injection attempts against the agent to perform harmful actions, but the external network dependency and parsing method warrant caution.