ClawHub
Back to skill

Security audit

Taobao and Tmall Product Reviews API

Security checks across malware telemetry and agentic risk

Overview

The skill appears to be a focused API wrapper, but it handles the required API token in a URL query parameter, which can leak through logs and monitoring systems.

Install only if you are comfortable giving the skill a JustOneAPI token and with that token being sent in the request URL. Prefer a low-privilege or revocable token, avoid running it where full URLs are logged, and rotate the token if you suspect logs or error reports captured request URLs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill requires the API token to be sent as a URL query parameter, which is unsafe because query strings are commonly logged by clients, proxies, gateways, browser/history systems, and observability tooling. Even though the request uses HTTPS, placing credentials in the URL increases the chance of accidental token disclosure far beyond using an Authorization header.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
Passing an access token in the query string is dangerous because query parameters are commonly logged by servers, intermediaries, analytics systems, browser histories, and debugging tools. That increases the chance of credential exposure and replay, especially since the manifest provides no warning or safer handling guidance for the secret.

Credential Access

High
Category
Privilege Escalation
Content
"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",
Confidence
92% confidence
Finding
Access token

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.