ClawHub
Back to skill

Security audit

Weibo Hot Search API

Security checks across malware telemetry and agentic risk

Overview

This is a narrow Weibo hot-search API wrapper, but it handles the required JustOneAPI token in ways that can expose it in command arguments and request URLs.

Install only if you are comfortable giving this skill a JustOneAPI token for Weibo hot-search data. Prefer a limited-scope token if available, avoid shared or heavily logged environments, and rotate the token if command history, process listings, proxy logs, or error traces may have exposed it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill defines the API access token as a query parameter and then appends it to the URL before issuing the request. Query-string secrets are commonly exposed through logs, browser/history mechanisms, proxy telemetry, referer propagation, and error reporting, so placing credentials in the URL materially increases the chance of token disclosure.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical
Code
suspicious.secret_argv_exposure
Location
SKILL.md:39