ClawHub
Back to skill

Security audit

Xiaohongshu Creator Marketplace (Pugongying) Creator Core Metrics API

Security checks across malware telemetry and agentic risk

Overview

This is a narrow JustOneAPI metrics helper with a real credential-handling caveat, but no hidden, destructive, or unrelated behavior was found.

Install only if you trust JustOneAPI and need this specific creator metrics endpoint. Keep JUST_ONE_API_TOKEN private, avoid sharing command lines or full request URLs, and rotate the token if it may have appeared in logs, screenshots, shell history, or process monitoring.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill defines the authentication token as a query parameter and appends it into the request URL, which causes the secret to appear in URLs. Query-string tokens are commonly exposed through logs, browser/history storage, proxy infrastructure, monitoring tools, and error messages, making accidental credential disclosure more likely even when HTTPS is used. In this skill's context, the token grants access to a third-party API, so leakage could allow unauthorized API use and access to creator metrics tied to the account.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The API requires an authentication token to be sent in the URL query string, which is a well-known insecure pattern because query parameters are commonly logged by clients, proxies, gateways, browser history, and monitoring systems. In this skill context, the token is the primary credential for accessing creator data, so accidental exposure could enable unauthorized API access or replay by anyone who obtains logged URLs.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The documentation requires a user authentication token in a query parameter but provides no warning about secure handling, storage, logging, or sharing of that credential. Query-string tokens are especially risky because they are commonly exposed in logs, browser history, analytics, proxies, and debugging output, which can lead to account or API access compromise if downstream integrators follow the documentation as written.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical
Code
suspicious.secret_argv_exposure
Location
SKILL.md:49