ClawHub
Back to skill

Security audit

TikTok Post Comments API

Security checks across malware telemetry and agentic risk

Overview

This skill is a focused JustOneAPI connector that fetches TikTok post comments using a user-supplied API token.

Install only if you trust JustOneAPI with your token and the TikTok post IDs you query. Keep JUST_ONE_API_TOKEN in an environment variable or secret manager, avoid logging full request URLs, rotate the token if you believe it was exposed, and handle returned comment/user data according to privacy and platform rules.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The skill defines the API token as a query parameter and injects it into the request URL, which causes the secret to be exposed in places URLs commonly end up: logs, browser/history equivalents, reverse proxies, monitoring systems, and error telemetry. Even though the request is sent over HTTPS, putting credentials in the URL materially increases accidental disclosure risk compared with sending them in an Authorization header or other header-based secret mechanism.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The API token is defined as a required query parameter, which causes credentials to be placed in URLs. Query parameters are commonly logged by servers, proxies, browser history, analytics tools, and monitoring systems, increasing the risk of accidental credential exposure and reuse by unauthorized parties.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.