Xiaohongshu Creator Marketplace (Pugongying) Creator Search API

• Risk level: Medium
• Analyzed: May 10, 2026, 8:01 PM
• Findings: 1
• Version: 1.0.0

Overview

This is a narrow JustOneAPI wrapper, but it tells the agent to pass your API token on the command line where it may be exposed locally.

Use only if you are comfortable sending your selected search parameters and JustOneAPI token to api.justoneapi.com. Prefer safer credential handling, such as updating the helper to read JUST_ONE_API_TOKEN directly from the environment instead of passing it with --token.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI03: Identity and Privilege Abuse

Medium

What this means

Another local user or diagnostic tooling could capture the JustOneAPI token and use it to make API calls under your account.

Why it was flagged

The instruction expands the API token into a command-line argument, and process arguments can be visible to local process listings or logs even though the token is meant to stay secret.

Skill content

node {baseDir}/bin/run.mjs --operation "apiSolarCooperatorBloggerV2V1" --token "$JUST_ONE_API_TOKEN" --params-json '{"key":"value"}'

Recommendation

Prefer a version that reads JUST_ONE_API_TOKEN directly from the environment or stdin rather than --token; if you use this skill, run it only on trusted machines and rotate the token if exposure is suspected.