ClawHub
Back to skill

Security audit

Bilibili Share Link Resolution API

Security checks for vulnerabilities and agentic risk

Overview

This skill is a narrow JustOneAPI helper for resolving Bilibili share links, with the main caveat that its API token is sent in the URL query string.

Install only if you trust JustOneAPI with the Bilibili share URLs you submit and with a scoped, revocable JUST_ONE_API_TOKEN. Avoid exposing token values in chat, screenshots, logs, or shell history, and rotate the token if you suspect URL logs captured it.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill defines the API access token as a query parameter and automatically injects it into the request URL. Query-string secrets are commonly exposed through logs, browser/history tooling, proxy layers, monitoring systems, and upstream services, so this increases the chance of credential leakage even when HTTPS is used.

Credential Access

High
Category
Privilege Escalation
Content
"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for the API.",
          "enumValues": [],
          "location": "query",
          "name": "token",
Confidence
96% confidence
Finding
The API requires an access token as a query parameter, which is risky because query strings are commonly logged by clients, servers, proxies, browser history, and monitoring systems. This increases the chance of credential exposure and subsequent unauthorized use of the third-party API, even though the token is intended for legitimate authentication.

Static analysis

No suspicious patterns detected.