Weibo TV Video Details API

• Verdict: Pass
• Analyzed: May 10, 2026, 6:43 AM
• Findings: 0
• Version: 1.0.0
• Hash: dafb01646ed7eb502006fbd96d9e0148a112f53c3a3208beaed28ada507b8d05
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: justoneapi-weibo-tv-component Version: 1.0.0 The skill is a standard API wrapper for fetching Weibo TV video details via JustOneAPI. The execution logic in bin/run.mjs is straightforward, using the built-in fetch API to make requests to a legitimate endpoint (api.justoneapi.com) without any signs of obfuscation, unauthorized data access, or malicious intent.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI03: Identity and Privilege Abuse

NoteHigh Confidence

What this means

Someone with access to the same machine or relevant logs could potentially see and reuse the JustOneAPI token.

Why it was flagged

The token is expected for this API call, but passing it as a CLI argument can expose it locally through process listings or command recording while the helper runs.

Skill content

node {baseDir}/bin/run.mjs --operation "tvComponentV1" --token "$JUST_ONE_API_TOKEN" --params-json '{"oid":"<oid>"}'

Recommendation

Use this only on trusted systems, avoid sharing command logs, and prefer a future helper version that reads JUST_ONE_API_TOKEN directly from the environment or stdin instead of argv.