ClawHub
Back to skill

Security audit

Xiaohongshu Creator Marketplace (Pugongying) Follower Growth History API

Security checks across malware telemetry and agentic risk

Overview

This is a narrow JustOneAPI wrapper, but its API token handling deserves review before installation.

Install only if you are comfortable sending creator userIds and your JustOneAPI token to api.justoneapi.com. Avoid logging full commands or request URLs, prefer a short-lived or scoped token if available, and consider waiting for a version that reads the token directly from a safer secret source and avoids query-string authentication.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill requires an authentication token to be sent as a query parameter and automatically injects it into the request URL. Query-string credentials are commonly exposed through logs, browser/history tooling, proxies, monitoring systems, crash reports, and upstream infrastructure, making accidental token disclosure more likely than with an Authorization header.

VirusTotal

39/39 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical
Code
suspicious.secret_argv_exposure
Location
SKILL.md:45