Toutiao API

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:35 PM UTC
• Version:
  1.0.7

Overview

This is a straightforward Toutiao API wrapper, with the main caveat that its JustOneAPI token is sent in the request URL.

Install only if you trust JustOneAPI and are comfortable with the token being included in API request URLs. Use a limited-scope or easily rotated token where possible, and avoid sharing logs, screenshots, or command output that may contain full request URLs.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The API authentication token is explicitly modeled as a query parameter and later appended into the request URL, which causes the secret to appear in URLs, logs, browser history, proxies, and upstream telemetry. Even though the destination uses HTTPS, query-string secrets are routinely exposed through server/access logs and observability systems, making credential leakage more likely than if the token were sent in an Authorization header.

VirusTotal

66/66 vendors flagged this skill as clean.