WeChat Official Accounts Keyword Search API

• Verdict: Pass
• Analyzed: May 10, 2026, 6:43 AM
• Findings: 0
• Version: 1.0.0
• Hash: 1b3d3359c9ed750a1111ae5e42086d72a18431579609067bc5a2ac44cd9c7ee6
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: justoneapi-weixin-search Version: 1.0.0 The skill bundle is a standard API wrapper for searching WeChat Official Accounts via JustOneAPI. The execution logic in bin/run.mjs is transparent, using the native fetch API to communicate exclusively with api.justoneapi.com, and the SKILL.md instructions contain appropriate security warnings regarding token handling without any evidence of prompt injection or malicious intent.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI03: Identity and Privilege Abuse

ConcernHigh Confidence

What this means

Someone or something with access to local process arguments while the command runs could see and reuse the JustOneAPI token.

Why it was flagged

The documented invocation expands the API token into the command-line arguments. Local process listings or tooling that captures command arguments may expose the token.

Skill content

node {baseDir}/bin/run.mjs --operation "searchWeixinV1" --token "$JUST_ONE_API_TOKEN" --params-json '{"keyword":"<keyword>"}'

Recommendation

Prefer a version that reads the token directly from the environment or stdin instead of argv; rotate the token if it may have been exposed.