ClawHub
Back to skill

Security audit

Facebook Get Profile ID API

Security checks across malware telemetry and agentic risk

Overview

This skill is a narrow JustOneAPI wrapper for one Facebook profile-ID lookup endpoint, with a real but disclosed credential-handling caveat.

Install only if you trust JustOneAPI with both the Facebook lookup input and your API token. Avoid sharing command lines, logs, screenshots, or full request URLs from this tool, and rotate the token if you think it may have appeared in logs or terminal history.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The skill defines the authentication token as a query parameter and later appends all query parameters directly into the request URL. Query-string credentials are commonly exposed via logs, browser/history equivalents, proxies, monitoring systems, crash reports, and server access logs, making accidental credential disclosure more likely than with an Authorization header. In this skill context, the risk is real because the tool is a generic API wrapper and provides no warning to users that their secret will be sent in the URL.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill requires an API authentication token to be sent in the URL query string, which is unsafe because query parameters are commonly logged by servers, proxies, browser history, monitoring tools, and analytics systems. This exposes credentials to unintended parties even when TLS is used, and the skill provides no warning to users that their secret will be transmitted to an external third-party service.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.