Scan Report
5 /100
JD.com
Analyze JD.com workflows with JustOneAPI, including product Details, product Comments, and shop Product List.
This is a straightforward API wrapper skill for JD.com product data with no malicious indicators found.
Safe to install
This skill is safe to use. It performs only simple GET requests to a declared external API endpoint for e-commerce data retrieval.
| Resource | Declared | Inferred | Status | Evidence |
|---|---|---|---|---|
| Filesystem | NONE | NONE | — | No file read/write operations in bin/run.mjs |
| Network | READ | READ | ✓ Aligned | bin/run.mjs:94 - fetch() to declared https://api.justoneapi.com endpoints only |
| Shell | NONE | NONE | — | Uses node to execute script, no subprocess or shell command execution |
| Environment | READ | READ | ✓ Aligned | Token passed via CLI argument --token, used only for API authentication |
| Skill Invoke | NONE | NONE | — | No skill invocation or cross-skill communication |
| Clipboard | NONE | NONE | — | No clipboard access in code |
| Browser | NONE | NONE | — | No browser automation |
| Database | NONE | NONE | — | No database operations |
1 findings
Medium External URL 外部 URL
https://api.justoneapi.com SKILL.md:5 File Tree
4 files · 18.4 KB · 615 lines JavaScript 1f · 344L
JSON 1f · 142L
Markdown 2f · 129L
├─
▾
bin
│ └─
run.mjs
JavaScript
├─
▾
generated
│ ├─
operations.json
JSON
│ └─
operations.md
Markdown
└─
SKILL.md
Markdown
Security Positives
✓ Clean, well-documented API wrapper with no obfuscation or suspicious code patterns
✓ All operations use only GET requests to declared endpoints
✓ Documentation accurately describes functionality with no hidden capabilities
✓ Token handling is minimal - only used for API authentication
✓ No environment variable iteration or credential harvesting
✓ No file system access, network exfiltration, or data theft behavior
✓ Pure Node.js implementation with no external dependencies
✓ Proper error handling with status code validation