Douyin Creator Marketplace (Xingtu) Follower Distribution API

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:42 PM UTC
• Version:
  1.0.0

Overview

This is a focused API wrapper for one JustOneAPI Douyin/Xingtu follower-distribution endpoint, with its token use disclosed and no hidden persistence or unrelated access found.

Install only if you trust JustOneAPI and are authorized to request Douyin/Xingtu audience analytics for the creator IDs you submit. Treat JUST_ONE_API_TOKEN as a secret, avoid logging full request URLs, and rotate the token if it is exposed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill defines the authentication token as a query parameter and injects it into the request URL, which can expose the secret in logs, browser/history equivalents, proxies, monitoring systems, crash reports, and upstream server access logs. Even though the request uses HTTPS, query strings are commonly recorded more broadly than headers, so this handling increases the chance of credential leakage.

VirusTotal

63/63 vendors flagged this skill as clean.