Security audit

Weibo Keyword Search API

Security checks across malware telemetry and agentic risk

Overview

This is a narrow Weibo search API wrapper, but it handles the API token in leak-prone places that users should review before installing.

Install only if you are comfortable using a JustOneAPI token with this helper. Prefer a revised version that reads the token directly from the environment or a credential store and avoids putting it in URLs or command-line arguments. Use a scoped token if available and rotate it if you suspect command history, process logs, proxy logs, or API logs captured it.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill defines an API access token as a query parameter, which causes credentials to be placed in URLs. Query strings are commonly logged by clients, proxies, browser history, server access logs, and monitoring systems, so the token can be exposed beyond its intended scope even when HTTPS is used.

Credential Access

High

Category: Privilege Escalation
Content: "parameters": [ { "defaultValue": null, "description": "API access token.", "enumValues": [], "location": "query", "name": "token",
Confidence: 82% confidence
Finding: access token

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical

Code: suspicious.secret_argv_exposure
Location: SKILL.md:49