Twitter User Published Posts API

• Risk level: Medium
• Analyzed: May 10, 2026, 7:59 PM
• Findings: 1
• Version: 1.0.0

Overview

The skill appears to call the stated JustOneAPI Twitter endpoint, but it handles the API token in a way that can expose it through command-line arguments.

Use this only if you are comfortable providing a JustOneAPI token, and consider modifying the helper or asking the publisher for an update so the token is read from the environment instead of passed with --token.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI03: Identity and Privilege Abuse

Medium

What this means

A local user, monitoring tool, or process-list collector could potentially see the JustOneAPI token while the command is running.

Why it was flagged

The documented command expands the credential into a command-line argument, where it may be visible to local process inspection tools or captured by process telemetry.

Skill content

node {baseDir}/bin/run.mjs --operation "getTwitterUserPostsV1" --token "$JUST_ONE_API_TOKEN" --params-json '{"restId":"<restId>"}'

Recommendation

Prefer a version of the helper that reads JUST_ONE_API_TOKEN directly from the environment or stdin instead of requiring --token on the command line.