Xiaohongshu Creator Marketplace (Pugongying) Note Performance Metrics API
ReviewAudited by ClawScan on May 10, 2026.
Overview
This is a focused JustOneAPI wrapper for one Xiaohongshu metrics endpoint, with a credential-handling caution because the example passes the API token through command-line arguments.
This skill appears coherent and narrowly scoped to a single authenticated metrics endpoint. Before installing, make sure you trust JustOneAPI with the requested Xiaohongshu lookup, provide only userIds you are authorized to query, and consider changing the helper or invocation so the API token is read from the environment rather than exposed on the command line.
Findings (1)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Someone with local process-inspection access on the same machine might see the JustOneAPI token while the command is running.
The skill requires a provider token and instructs passing it as a command-line argument; this is purpose-aligned for authentication, but command-line arguments can be exposed locally through process listings or shell history depending on how it is run.
node {baseDir}/bin/run.mjs --operation "apiSolarKolDataV3NotesRateV1" --token "$JUST_ONE_API_TOKEN" --params-json '{"userId":"<userId>"}'Prefer a helper that reads JUST_ONE_API_TOKEN directly from the environment instead of passing it via `--token`, and avoid running it on shared systems where other users can inspect processes.