Bilibili API Security Report — Low Risk | ClawSafe

5 /100

Bilibili API

Analyze Bilibili workflows with JustOneAPI, including video Details, user Published Videos, and user Profile across 9 operations.

Clean API wrapper skill that performs documented Bilibili API operations via GET requests to a single trusted endpoint.

Skill NameBilibili API

Duration35.7s

Enginepi

✓

Safe to install

No action required. This is a straightforward API wrapper with no malicious indicators.

Findings 1 items

Severity	Finding	Location
Low	API Token in CLI Arguments Credential Theft The JUST_ONE_API_TOKEN is passed via --token command-line argument, making it visible in process listings (ps aux). This is a minor operational concern but not exfiltration. `injectToken(operation, params, args.token)` → Consider using environment variables internally within the skill sandbox rather than CLI arguments for better credential hygiene.	`bin/run.mjs:47`

Resource	Declared	Inferred	Status	Evidence
Filesystem	`NONE`	`NONE`	—	No file read/write operations in bin/run.mjs
Network	`READ`	`READ`	✓ Aligned	Uses native fetch() for outbound GET to api.justoneapi.com only (line 1 in manif…
Shell	`NONE`	`NONE`	—	No subprocess, exec, or shell command execution
Environment	`READ`	`NONE`	✓ Aligned	Token injected via CLI argument, not read from process.env

1 findings

🔗

Medium External URL 外部 URL

https://api.justoneapi.com

SKILL.md:5

4 files · 39.5 KB · 1332 lines

JavaScript 1f · 626L JSON 1f · 424L Markdown 2f · 282L

├─ ▾ 📁 bin

│ └─ 📜 run.mjs JavaScript 626L · 17.6 KB

├─ ▾ 📁 generated

│ ├─ 📋 operations.json JSON 424L · 12.2 KB

│ └─ 📝 operations.md Markdown 226L · 6.6 KB

└─ 📝 SKILL.md Markdown 56L · 3.1 KB

✓ No obfuscation techniques (base64, eval, atob) detected

✓ No sensitive path access (~/.ssh, ~/.aws, .env)

✓ No remote script execution (curl|bash, wget|sh)

✓ No credential harvesting or environment variable enumeration

✓ No C2 communication or data exfiltration

✓ Only uses native Node.js fetch() API, no external dependencies

✓ Clean, well-structured code matching documentation

✓ All network requests go to documented endpoint: api.justoneapi.com

✓ GET-only requests, no POST/PUT/DELETE with data exfiltration potential