Weibo Post Comments API

• Outcome: Review
• Latest audit: May 29, 2026 at 9:38 PM UTC
• Version:
  1.0.0

Overview

The skill only calls the advertised Weibo comments API, but it passes the JustOneAPI token in places that can expose it unnecessarily.

Install only if you trust JustOneAPI and are comfortable sending a JustOneAPI token to api.justoneapi.com as a URL query parameter. Use a limited-scope token if available, avoid sharing command logs or full request URLs, and rotate the token if it may have appeared in logs or telemetry.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill defines the API token as a query parameter and automatically injects it into the request URL. Query-string credentials are commonly exposed through logs, browser/history tooling, upstream proxies, monitoring systems, and error traces, making accidental credential disclosure more likely even when HTTPS is used.

VirusTotal

65/65 vendors flagged this skill as clean.