Twitter User Profile API
WarnAudited by ClawScan on May 10, 2026.
Overview
The skill appears to call the advertised JustOneAPI Twitter profile endpoint, but it passes the API token on the command line where it may be exposed locally.
Only install or use this skill if you are comfortable providing a JustOneAPI token. Consider modifying the helper to read JUST_ONE_API_TOKEN from the environment directly rather than passing it with --token, and avoid running it on shared systems where other users can inspect process arguments.
Findings (1)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Another local user or process could potentially observe the JustOneAPI token while the command is running and use it outside this skill.
The instructions pass a high-value API token as a command-line argument, which can be visible to local process inspection tools even though the credential itself is purpose-aligned.
node {baseDir}/bin/run.mjs --operation "getTwitterUserDetailV1" --token "$JUST_ONE_API_TOKEN" --params-json '{"restId":"<restId>"}'Prefer a helper that reads JUST_ONE_API_TOKEN directly from the environment instead of accepting it through argv, and rotate the token if you suspect it was exposed.