YOUKU Video Search API

• Outcome: Review
• Latest audit: May 29, 2026, 9:38 PM
• Version:
  1.0.0

Overview

The skill is a focused YOUKU search API wrapper, but it handles the API token in ways that can expose it through command arguments and request URLs.

Review before installing if your JustOneAPI token has billing, account, or broad API access. The skill appears to do what it claims and does not show hidden persistence or destructive behavior, but use a scoped/rotatable token and avoid environments that log process arguments or full request URLs.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill requires a sensitive API token and places it in the URL query string, which is routinely exposed to logs, proxies, browser/history tooling, monitoring systems, and upstream infrastructure. Even though the request uses HTTPS, query parameters are still more broadly recorded than headers, so the token can be unintentionally disclosed to operators or third-party services.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The manifest requires a token to be sent as a query parameter to an external API, but provides no user-facing warning about credential handling or external transmission. Query parameters are more likely to be logged by clients, proxies, gateways, and server access logs, increasing the chance of credential exposure and unauthorized reuse.

VirusTotal

64/64 vendors flagged this skill as clean.