Zhihu Keyword Search API

• Analyzed: May 10, 2026, 6:43 AM
• Findings: 0
• Version: 1.0.0
• Hash: 698c96dfbd1f5b22c7caf156d74de468febee939b1b4be1d2b9b509f8a415e75
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: justoneapi-zhihu-search Version: 1.0.0 The skill is a standard API wrapper for performing Zhihu keyword searches via the JustOneAPI service (api.justoneapi.com). The implementation in bin/run.mjs is straightforward, using the built-in fetch API to make authorized requests without any signs of data exfiltration, shell execution, or malicious prompt injection.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI03: Identity and Privilege Abuse

Concern

What this means

On a shared or monitored machine, another local user, process, or log collector could capture the JustOneAPI token and use it outside this skill.

Why it was flagged

This directs the helper to receive the provider token through process argv. The token is purpose-aligned, but command-line arguments may be visible to local process inspection, shell/debug tooling, or command telemetry.

Skill content

node {baseDir}/bin/run.mjs --operation "searchZhihuV1" --token "$JUST_ONE_API_TOKEN" --params-json '{"keyword":"<keyword>"}'

Recommendation

Prefer a version that reads JUST_ONE_API_TOKEN directly from the environment or stdin instead of argv; if used, run only on trusted machines and rotate the token if exposure is suspected.