Weibo TV Video Details API

• Verdict: Pass
• Confidence: High
• Analyzed: May 10, 2026, 8:01 PM
• Findings: 1
• Version: 1.0.0

Overview

This is a focused JustOneAPI wrapper for one Weibo video lookup, with the main caution that its API token is passed on the command line.

Before installing, confirm you trust JustOneAPI and are comfortable providing a JUST_ONE_API_TOKEN. Run it only in a trusted environment, avoid exposing command output or process details, and rotate the token if you think it may have been visible to others.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI03: Identity and Privilege Abuse

NoteHigh Confidence

What this means

Someone with access to the same machine or relevant logs could potentially see and reuse the JustOneAPI token.

Why it was flagged

The token is expected for this API call, but passing it as a CLI argument can expose it locally through process listings or command recording while the helper runs.

Skill content

node {baseDir}/bin/run.mjs --operation "tvComponentV1" --token "$JUST_ONE_API_TOKEN" --params-json '{"oid":"<oid>"}'

Recommendation

Use this only on trusted systems, avoid sharing command logs, and prefer a future helper version that reads JUST_ONE_API_TOKEN directly from the environment or stdin instead of argv.