抖音热榜神器 — 可以实时追踪抖音热点、挖掘爆款规律，并支持历史热榜数据回溯。使用时只需输入“查抖音热榜”“抖音热搜”“今日热榜”“近7天热榜”“历史热榜”等触发词，或订阅热榜推送，即可快速获取当前及过往的热门话题，帮助内容创作者和运营者高效蹭热点、找选题。

Things to consider before installing or running this skill: - Unknown upstream API: both scripts call https://onetotenvip.com via a hard-coded IP (8.154.41.7). Ask the author for the data source, why that host/IP is used, and whether it is a trusted vendor. Hard-coded IPs can hide where data is going. - Disabled TLS verification & no SNI: the code sets verify_mode=CERT_NONE and server_hostname=None. That disables certificate validation and SNI, making the TLS connection vulnerable to interception and removing a key authenticity check. Request a justification or a change to standard HTTPS requests (requests/urllib with proper cert validation). - Contradictory data rules: SKILL.md forbids modifying API data, yet the scripts remove whitespace from titles and generate synthetic 'desc' text. Decide whether you trust the generated summaries and the fact that titles are altered; this contradicts claims of 'do not modify' original data. - Push/subscription model is not implemented: the docs require hourly/daily push and recording preferences but there is no background scheduler, persistence mechanism, or service endpoint. Clarify how subscriptions are stored and how pushes are delivered (webhook, email, external service?). Without this, promised automation cannot function. - Forced HTML/PDF output and in-reply dumping: the workflow requires the agent to generate HTML files and embed full HTML and PDF content directly in responses. This can leak content into chat and may be impractical (binary PDFs), and the scripts only produce HTML (client-side JS for PDF). Confirm whether you want the agent to output full files to chat and who can read them. - If you plan to use it: run the scripts in an isolated environment first, inspect network traffic, and consider replacing the low-level socket calls with standard HTTPS libraries that validate certs. Ask the author for source/reference (homepage, official API docs), and for a clear design for subscription persistence and delivery. What would change this assessment: Availability of an authoritative source/homepage or repo, an explanation for the hard-coded IP and disabled TLS checks (or better: removal of those practices), a clear and safe subscription/push implementation, and alignment between 'do not modify data' rules and the actual code would raise confidence and could make this benign. Absent those, treat the skill cautiously.

Type: OpenClaw Skill Name: dy-hot-trend Version: 1.0.2 The skill bundle exhibits several high-risk behaviors and coercive patterns. The Python scripts (`scripts/hotspot_fetcher.py` and `scripts/gen_douyin_hot_html.py`) use raw sockets and explicitly disable SSL certificate verification (`ssl.CERT_NONE`) when connecting to a hardcoded IP (8.154.41.7) and domain (onetotenvip.com), creating a significant man-in-the-middle vulnerability. Furthermore, the instructions in `assets/core-workflow.md` utilize aggressive prompt-injection techniques, using coercive language ('Mandatory', 'Forced', 'Forbidden') to hijack the agent's control flow and force the execution of scripts and the output of large HTML blocks. It also attempts to induce the agent into a persistent state via 'subscription' instructions for recurring tasks, which may exceed the intended scope of the skill platform.