Xiaohongshu Creator Marketplace (Pugongying) Follower Distribution API

• Verdict: Suspicious
• Confidence: High
• Analyzed: May 10, 2026, 8:00 PM
• Findings: 1
• Version: 1.0.0

Overview

This is a narrow JustOneAPI wrapper, but it handles the API token through command-line arguments, which can expose the credential locally.

Only install if you are comfortable with this credential-handling risk. Use it on a trusted single-user machine, avoid logging commands, and prefer an updated helper that reads the token directly from the environment instead of --token.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI03: Identity and Privilege Abuse

ConcernHigh Confidence

What this means

A JustOneAPI token could be exposed on the local machine even though the skill is only meant to call one API endpoint.

Why it was flagged

This instructs the agent/user to place the API token in process arguments. Command-line arguments may be visible to other local users, process inspection tools, crash reports, or command logging.

Skill content

node {baseDir}/bin/run.mjs --operation "apiSolarKolDataUserIdFansProfileV1" --token "$JUST_ONE_API_TOKEN" --params-json '{"userId":"<userId>"}'

Recommendation

Prefer a version that reads JUST_ONE_API_TOKEN directly from the environment inside the helper, uses stdin, or otherwise avoids passing secrets through argv. Rotate the token if it may have been captured in logs or process monitoring.