ClawHub

Weibo API

Security checks across malware telemetry and agentic risk

Overview

The skill appears to be a legitimate API integration, but it repeatedly puts API tokens in URLs and enables broad social-profile data collection without enough safety guidance.

Review before installing. Use a low-scope, revocable API token, avoid logging full request URLs, and rotate the token if it may have appeared in logs. Only use the social-profile and follower data features where you have a lawful, platform-compliant reason, and avoid storing or sharing unnecessary personal data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (15)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The code appends the API token as a URL query parameter, which can leak secrets through logs, browser history, intermediary proxies, monitoring systems, and error traces even when HTTPS is used. In this skill context, every operation requires the token and the wrapper automatically injects it, so the exposure pattern is systemic rather than isolated.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The OpenAPI spec requires an API access token to be supplied in the URL query string, which commonly leaks through logs, browser history, proxy caches, analytics systems, and referrer headers. In a skill context, this is a real credential-handling weakness because downstream clients are likely to follow the spec exactly and expose the token more broadly than if it were sent in an Authorization header.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill documents an API design that requires the access token to be passed in the URL query string. Query parameters are commonly captured in browser history, proxy logs, analytics systems, reverse proxies, and server access logs, which increases the chance of credential leakage even when TLS is used. Because this is an API integration skill, the issue is more dangerous than generic documentation: implementers may copy this pattern directly into production agents and expose reusable credentials.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill explicitly enables collection of fans, followers, profile metadata, and verification signals for audience analysis and influencer research without any privacy, consent, retention, or lawful-use warning. This creates a real privacy/compliance risk because it encourages bulk collection and profiling of social graph data that may be personal data under platform policies or privacy law. In context, the skill is specifically built for tracking and analysis, which makes misuse for surveillance or unauthorized profiling more plausible.

Credential Access

High
Category
Privilege Escalation
Content
"parameters": [
        {
          "defaultValue": null,
          "description": "API access token.",
          "enumValues": [],
          "location": "query",
          "name": "token",
Confidence
95% confidence
Finding
access token

Credential Access

High
Category
Privilege Escalation
Content
"parameters": [
        {
          "defaultValue": null,
          "description": "API access token.",
          "enumValues": [],
          "location": "query",
          "name": "token",
Confidence
95% confidence
Finding
access token

Credential Access

High
Category
Privilege Escalation
Content
"parameters": [
        {
          "defaultValue": null,
          "description": "API access token.",
          "enumValues": [],
          "location": "query",
          "name": "token",
Confidence
95% confidence
Finding
access token

Credential Access

High
Category
Privilege Escalation
Content
"parameters": [
        {
          "defaultValue": null,
          "description": "API access token.",
          "enumValues": [],
          "location": "query",
          "name": "token",
Confidence
95% confidence
Finding
access token

Credential Access

High
Category
Privilege Escalation
Content
"parameters": [
        {
          "defaultValue": null,
          "description": "API access token.",
          "enumValues": [],
          "location": "query",
          "name": "token",
Confidence
95% confidence
Finding
access token

Credential Access

High
Category
Privilege Escalation
Content
"parameters": [
        {
          "defaultValue": null,
          "description": "API access token.",
          "enumValues": [],
          "location": "query",
          "name": "token",
Confidence
95% confidence
Finding
access token

Credential Access

High
Category
Privilege Escalation
Content
"parameters": [
        {
          "defaultValue": null,
          "description": "API access token.",
          "enumValues": [],
          "location": "query",
          "name": "token",
Confidence
95% confidence
Finding
access token

Credential Access

High
Category
Privilege Escalation
Content
"parameters": [
        {
          "defaultValue": null,
          "description": "API access token.",
          "enumValues": [],
          "location": "query",
          "name": "token",
Confidence
95% confidence
Finding
access token

Credential Access

High
Category
Privilege Escalation
Content
"parameters": [
        {
          "defaultValue": null,
          "description": "API access token.",
          "enumValues": [],
          "location": "query",
          "name": "token",
Confidence
95% confidence
Finding
access token

Credential Access

High
Category
Privilege Escalation
Content
"parameters": [
        {
          "defaultValue": null,
          "description": "API access token.",
          "enumValues": [],
          "location": "query",
          "name": "token",
Confidence
95% confidence
Finding
access token

Credential Access

High
Category
Privilege Escalation
Content
"parameters": [
        {
          "defaultValue": null,
          "description": "API access token.",
          "enumValues": [],
          "location": "query",
          "name": "token",
Confidence
95% confidence
Finding
access token

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal