中文 EN

扫描报告

扫描新文件

✓ 低风险 — 风险评分 5/100
上次扫描：1 天前 重新扫描
5 /100
Bilibili API
Analyze Bilibili workflows with JustOneAPI, including video Details, user Published Videos, and user Profile across 9 operations.
Clean API wrapper skill that performs documented Bilibili API operations via GET requests to a single trusted endpoint.
技能名称Bilibili API
分析耗时35.7s
引擎pi
✓
可以安装
No action required. This is a straightforward API wrapper with no malicious indicators.

安全发现 1 项

严重性 安全发现 位置
低危
API Token in CLI Arguments 凭证窃取
The JUST_ONE_API_TOKEN is passed via --token command-line argument, making it visible in process listings (ps aux). This is a minor operational concern but not exfiltration.
injectToken(operation, params, args.token)
→ Consider using environment variables internally within the skill sandbox rather than CLI arguments for better credential hygiene.
 bin/run.mjs:47
资源类型声明权限推断权限状态证据
文件系统 NONE NONE — No file read/write operations in bin/run.mjs
网络访问 READ READ ✓ 一致 Uses native fetch() for outbound GET to api.justoneapi.com only (line 1 in manif…
命令执行 NONE NONE — No subprocess, exec, or shell command execution
环境变量 READ NONE ✓ 一致 Token injected via CLI argument, not read from process.env
1 项发现
🔗
中危 外部 URL 外部 URL
https://api.justoneapi.com
SKILL.md:5

目录结构

4 文件 · 39.5 KB · 1332 行
JavaScript 1f · 626L JSON 1f · 424L Markdown 2f · 282L
├─ ▾ 📁 bin
│ └─ 📜 run.mjs JavaScript 626L · 17.6 KB
├─ ▾ 📁 generated
│ ├─ 📋 operations.json JSON 424L · 12.2 KB
│ └─ 📝 operations.md Markdown 226L · 6.6 KB
└─ 📝 SKILL.md Markdown 56L · 3.1 KB

安全亮点

✓ No obfuscation techniques (base64, eval, atob) detected
✓ No sensitive path access (~/.ssh, ~/.aws, .env)
✓ No remote script execution (curl|bash, wget|sh)
✓ No credential harvesting or environment variable enumeration
✓ No C2 communication or data exfiltration
✓ Only uses native Node.js fetch() API, no external dependencies
✓ Clean, well-structured code matching documentation
✓ All network requests go to documented endpoint: api.justoneapi.com
✓ GET-only requests, no POST/PUT/DELETE with data exfiltration potential