Weibo User Followers API

• Verdict: Pass
• Analyzed: May 10, 2026, 6:42 AM
• Findings: 0
• Version: 1.0.0
• Hash: 730a139b6f3c28fc252f57150ea46371177ea78aa48272b7b2e8b26bd7c305ed
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: justoneapi-weibo-get-followers Version: 1.0.0 The skill is a standard API wrapper for fetching Weibo follower data via JustOneAPI. The execution script (bin/run.mjs) implements straightforward logic to make authenticated GET requests to api.justoneapi.com using a provided token. There is no evidence of data exfiltration, malicious code execution, or harmful prompt injection instructions.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI03: Identity and Privilege Abuse

ConcernHigh Confidence

What this means

On shared machines or systems with command/process telemetry, another local user or logging tool could capture the JustOneAPI token and use the account or quota.

Why it was flagged

The official run instruction passes the API token as a command-line argument. When executed, the environment variable is expanded and the secret can be exposed through process arguments.

Skill content

node {baseDir}/bin/run.mjs --operation "getFollowersV1" --token "$JUST_ONE_API_TOKEN" --params-json '{"uid":"<uid>"}'

Recommendation

Prefer a helper that reads JUST_ONE_API_TOKEN directly from the environment or a secret manager instead of argv, avoid running this on shared systems, and rotate the token if it may have been exposed.