Douyin Creator Marketplace (Xingtu) Audience Touchpoint Distribution API

Call GET /api/douyin-xingtu/gw/api/data_sp/author_touch_distribution/v1 for Douyin Creator Marketplace (Xingtu) Audience Touchpoint Distribution through Just...

Security Scan

The skill is internally consistent with its claimed purpose: it calls the JustOneAPI endpoint to fetch Douyin/Xingtu audience distribution and only requires node and a JustOneAPI token.

Purpose & Capability

Name/description, required binary (node), and the single required env var (JUST_ONE_API_TOKEN) are appropriate and expected for a small CLI wrapper that calls JustOneAPI. Nothing else (unrelated credentials, extra binaries, or config paths) is requested.

Instruction Scope

SKILL.md instructs calling the bundled bin/run.mjs with --operation, --token, and --params-json; the code implements exactly that and only builds an HTTPS request to https://api.justoneapi.com. It does not read other files or environment variables. Minor mismatch: SKILL.md suggests the agent should print a short summary then raw JSON, but the run.mjs script writes only the raw JSON to stdout (no summary)—this is a formatting/UX mismatch, not a security issue.

Install Mechanism

This is an instruction/CLI-only skill with no install spec. No downloads or archive extraction are performed. Risk is low — the included code is a small, self-contained Node script.

Credentials

Requesting JUST_ONE_API_TOKEN is proportional to calling the third-party API. One security caveat: the run.mjs injects the token into the request as a query parameter (token=...), which can expose secrets in server logs, reverse-proxy logs, or referrer headers. Using an Authorization header would be safer. The skill itself does not request unrelated secrets.

Persistence & Privilege

The skill does not request always:true, does not modify other skills or system settings, and does not persist credentials. Autonomous invocation is allowed but that is the platform default and not by itself concerning here.

Assessment

This skill appears to do what it claims: it is a small Node CLI wrapper that calls JustOneAPI's Douyin/Xingtu endpoint and requires JUST_ONE_API_TOKEN. Before installing: (1) Ensure you trust https://api.justoneapi.com and the token provider; (2) Be aware the script sends your token as a URL query parameter, which can be logged by servers or proxies—avoid using high-privilege tokens or rotate them often; (3) Do not paste your token into chat or public logs; pass it via environment variable as instructed; (4) If you need the agent to show a human-friendly summary, note the script only emits raw JSON and you may need additional formatting in the agent. If you want extra safety, request the vendor to use Authorization headers instead of query tokens or run the CLI in an environment where outgoing requests are monitored.

Douyin Creator Marketplace (Xingtu) Audience Touchpoint Distribution

Use this focused JustOneAPI skill for audience Touchpoint Distribution in Douyin Creator Marketplace (Xingtu). It targets GET /api/douyin-xingtu/gw/api/data_sp/author_touch_distribution/v1. Required non-token inputs are oAuthorId. OpenAPI describes it as: Get Douyin Creator Marketplace (Xingtu) audience Touchpoint Distribution data, including segment breakdowns, audience composition, and distribution signals, for creator evaluation, campaign planning, and marketplace research.

Endpoint Scope

• Platform key: douyin-xingtu
• Endpoint key: gw/api/data_sp/author_touch_distribution
• Platform family: Douyin Creator Marketplace (Xingtu)
• Skill slug: justoneapi-douyin-xingtu-gw-api-data-sp-author-touch-distribution

Operation	Version	Method	Path	OpenAPI summary
gwApiDataSpAuthorTouchDistributionV1	v1	GET	/api/douyin-xingtu/gw/api/data_sp/author_touch_distribution/v1	Audience Touchpoint Distribution

Inputs

Parameter	In	Required by	Optional by	Type	Notes
oAuthorId	query	all	n/a	string	Author's unique ID
platform	query	n/a	all	string	Platform type. Available Values: - SHORT_VIDEO: Short video - LIVE_STREAMING: Live streaming - PICTURE_TEXT: Picture and text - SHORT_DRAMA: Short drama
platform enum	values	n/a	n/a	n/a	LIVE_STREAMING, PICTURE_TEXT, SHORT_DRAMA, SHORT_VIDEO

Request body: none documented; send parameters through path or query arguments.

Version Choice

Use gwApiDataSpAuthorTouchDistributionV1 for the documented v1 endpoint. There are no alternate versions grouped in this skill.

Run This Endpoint

Supported operation IDs in this skill: gwApiDataSpAuthorTouchDistributionV1.

node {baseDir}/bin/run.mjs --operation "gwApiDataSpAuthorTouchDistributionV1" --token "$JUST_ONE_API_TOKEN" --params-json '{"oAuthorId":"<oAuthorId>"}'

Ask for any missing required parameter before calling the helper. Keep user-provided IDs, cursors, keywords, and filters unchanged.

Environment

• Required: JUST_ONE_API_TOKEN
• Pass the token with --token "$JUST_ONE_API_TOKEN"; do not paste token values into chat messages, screenshots, or logs.
• Get a token from Just One API Dashboard.
• Authentication details: Just One API Usage Guide.

Output Focus

• State the operation ID and endpoint path used, for example gwApiDataSpAuthorTouchDistributionV1 on /api/douyin-xingtu/gw/api/data_sp/author_touch_distribution/v1.
• Echo the required lookup scope (oAuthorId) before summarizing results.
• Prioritize fields that support this endpoint purpose: Get Douyin Creator Marketplace (Xingtu) audience Touchpoint Distribution data, including segment breakdowns, audience composition, and distribution signals, for creator evaluation, campaign planning, and marketplace research.
• Return raw JSON only after the short, endpoint-specific summary.
• If the backend errors, include the backend payload and the exact operation ID.