Kuaishou User Published Videos API

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:43 PM UTC
• Version:
  1.0.0

Overview

This is a narrow JustOneAPI helper for fetching Kuaishou published-video data, with the main caution being careful handling of the API token.

Install only if you trust JustOneAPI and are comfortable sending your JUST_ONE_API_TOKEN to api.justoneapi.com. Keep the token in the environment, avoid pasting it into chats or logs, and treat command lines or URLs containing the token as sensitive.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill defines the API access token as a query parameter and later appends all query parameters directly to the request URL. Query-string credentials are commonly exposed through logs, browser/history tooling, proxy caches, monitoring systems, and error messages, making accidental credential leakage significantly more likely even when HTTPS is used.

VirusTotal

65/65 vendors flagged this skill as clean.