ClawHub
Back to skill

Security audit

Weibo Post Details API

Security checks across malware telemetry and agentic risk

Overview

This skill does the advertised Weibo lookup, but it handles the API token in ways that can expose it through command arguments and request URLs.

Review before installing. Use only a limited, rotatable JustOneAPI token, avoid running this on shared machines, and assume the token may appear in process listings or URL logs until the skill is changed to read secrets from a safer channel and avoid query-string authentication where possible.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The skill defines the API access token as a query parameter and later appends all query parameters directly into the request URL. Tokens in URLs are commonly exposed through logs, browser/history records, proxy caches, monitoring systems, referrer leakage, and error reporting, making credential disclosure more likely than if the token were sent in an Authorization header.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical
Code
suspicious.secret_argv_exposure
Location
SKILL.md:41