Weibo Search User Published Posts API

• Verdict: Pass
• Analyzed: May 10, 2026, 6:42 AM
• Findings: 0
• Version: 1.0.0
• Hash: be2eeda3577ce811448ddecf373d340878534a31df250f7342592996e8bb1dd8
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: justoneapi-weibo-search-profile Version: 1.0.0 The skill is a standard API wrapper for searching Weibo posts via JustOneAPI. The implementation in `bin/run.mjs` is a straightforward Node.js script that uses the built-in fetch API to communicate exclusively with `api.justoneapi.com`. It includes proper input handling such as URL encoding for parameters and does not exhibit any signs of data exfiltration, command injection, or malicious prompt instructions.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI03: Identity and Privilege Abuse

ConcernHigh Confidence

What this means

If the token is exposed, someone else may be able to use your JustOneAPI account or quota.

Why it was flagged

The default invocation expands the JustOneAPI credential into a command-line argument, which can be visible to local process monitors, shell wrappers, or command logging on some systems.

Skill content

node {baseDir}/bin/run.mjs --operation "searchProfileV1" --token "$JUST_ONE_API_TOKEN" --params-json '{"uid":"<uid>","q":"<q>"}'

Recommendation

Use only in a trusted environment, prefer a version that reads JUST_ONE_API_TOKEN directly from the environment or a secret manager instead of argv, and rotate the token if it may have been exposed.