Weibo User Published Posts API

• Outcome: Review
• Latest audit: May 29, 2026 at 9:38 PM UTC
• Version:
  1.0.0

Overview

This skill appears to do what it says, but it should be reviewed because it handles the required API token in exposed places.

Install only if you trust JustOneAPI and have a legitimate, lawful reason to retrieve the target Weibo account's published posts. Use a limited and revocable token where possible, avoid sharing logs or command output, and prefer a version that keeps the token out of command arguments and URL query strings.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill defines the API access token as a query parameter and automatically appends it to the request URL. Query-string credentials are commonly exposed through logs, browser/history tooling, proxy layers, monitoring systems, and error traces, so the token may be disclosed beyond the intended recipient.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The skill explicitly enables retrieval of a Weibo user's published posts for account monitoring, which is privacy-sensitive profiling functionality. Even if the posts are nominally public, the description lacks any warning, consent guidance, or use restrictions, making it easier to use the API for surveillance, bulk monitoring, or unauthorized tracking of individuals.

VirusTotal

65/65 vendors flagged this skill as clean.