Douban Movie API

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward read-only Douban Movie API wrapper, with the main caution that its JustOneAPI token is sent in URL query parameters.

Install only if you trust JustOneAPI and can use a token you can revoke or rotate. Avoid sharing logs, screenshots, or full request URLs because the token may appear in the URL query string; use a narrowly scoped token if the provider supports it.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (15)

Missing User Warnings

Medium

Confidence: 99% confidence
Finding: The skill sends the API access token as a URL query parameter, which is commonly logged by clients, proxies, gateways, browser history, and server access logs. Even over HTTPS, placing secrets in the URL increases the chance of accidental credential disclosure and reuse by unauthorized parties.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: This API requires an access token to be sent as a query parameter, which is risky because query strings are commonly logged by clients, proxies, servers, analytics tools, and browser history. Even over HTTPS, token exposure in logs or telemetry can lead to credential leakage and unauthorized reuse.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: These additional operations repeat the same insecure authentication pattern by placing the required access token in the query string. Repetition across multiple endpoints increases the chance of credential exposure through request logs, monitoring systems, and accidental sharing of full URLs.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: Requiring an access token in the query string is risky because query parameters are commonly logged by clients, proxies, gateways, browser histories, and observability systems. Even if sent over HTTPS, the token may be exposed in logs or shared URLs, enabling unauthorized reuse of the credential.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: This endpoint also places a required access token in the URL query, which increases the chance of credential leakage through request logging, analytics, caches, and copied links. Because the token grants access to an external API service, exposure could allow unintended third parties to consume the service or access associated data.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The repeated pattern of documenting tokens in query parameters normalizes insecure credential handling across the skill. This broadens the exposure surface because every endpoint invocation may leak secrets into logs or monitoring systems, making accidental compromise more likely.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: Embedding access tokens in query strings for this discovery endpoint creates the same credential exposure risk as the other operations, with no warning to users. In an agent/tooling context, URLs are especially likely to be stored or surfaced in debug output, increasing the practical chance of token disclosure.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: This endpoint continues the insecure design of transmitting API credentials via query parameters, which can leak through infrastructure components outside the author's control. A leaked token could be replayed by an attacker until revoked or expired, causing unauthorized API usage and possible privacy or billing impact.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The subject-detail endpoint likewise requires sensitive credentials in the query string without cautionary guidance. This is dangerous because URL-based secrets are frequently captured in server logs, reverse proxies, support tickets, and monitoring dashboards, creating multiple accidental disclosure channels.

Credential Access

High

Category: Privilege Escalation
Content: "parameters": [ { "defaultValue": null, "description": "Access token for this API service.", "enumValues": [], "location": "query", "name": "token",
Confidence: 97% confidence
Finding: Access token

Credential Access

High

Category: Privilege Escalation
Content: "parameters": [ { "defaultValue": null, "description": "Access token for this API service.", "enumValues": [], "location": "query", "name": "token",
Confidence: 97% confidence
Finding: Access token

Credential Access

High

Category: Privilege Escalation
Content: "parameters": [ { "defaultValue": null, "description": "Access token for this API service.", "enumValues": [], "location": "query", "name": "token",
Confidence: 97% confidence
Finding: Access token

Credential Access

High

Category: Privilege Escalation
Content: "parameters": [ { "defaultValue": null, "description": "Access token for this API service.", "enumValues": [], "location": "query", "name": "token",
Confidence: 97% confidence
Finding: Access token

Credential Access

High

Category: Privilege Escalation
Content: "parameters": [ { "defaultValue": null, "description": "Access token for this API service.", "enumValues": [], "location": "query", "name": "token",
Confidence: 97% confidence
Finding: Access token

Credential Access

High

Category: Privilege Escalation
Content: "parameters": [ { "defaultValue": null, "description": "Access token for this API service.", "enumValues": [], "location": "query", "name": "token",
Confidence: 97% confidence
Finding: Access token

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal