Xiaohongshu Creator Marketplace (Pugongying) Creator Feature Tags API
ReviewAudited by ClawScan on May 10, 2026.
Overview
This is a straightforward read-only JustOneAPI wrapper, with the main caution that its API token is passed on the command line where it may be visible locally.
Before installing, confirm you trust JustOneAPI and that your JUST_ONE_API_TOKEN is scoped appropriately. The skill appears limited to one read-only endpoint, but avoid running it on shared or untrusted systems because the token is passed as a command-line argument.
Findings (1)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A local user or monitoring tool could potentially see the JustOneAPI token during execution, and that token may allow API usage on the user's account.
The skill requires a JustOneAPI token and instructs passing it through a command-line argument. This is purpose-aligned for the API call, but command-line arguments may be visible to other local processes or diagnostics while the helper runs.
node {baseDir}/bin/run.mjs --operation "apiSolarKolDataV2KolFeatureTagsV1" --token "$JUST_ONE_API_TOKEN" --params-json '{"userId":"<userId>"}'Use this only on trusted machines, keep the token scoped and rotated as appropriate, and prefer a helper version that reads JUST_ONE_API_TOKEN directly from the environment rather than passing it via --token.