Security audit

Beike Resale Housing Details API

Security checks for vulnerabilities and agentic risk

Overview

This skill is a narrow JustOneAPI wrapper for one Beike housing-detail endpoint, with no evidence of hidden behavior or persistence.

Install only if you are comfortable giving this skill a JustOneAPI token for the Beike housing-detail endpoint. Prefer a low-scope or revocable token, avoid logging full commands or URLs, and rotate the token if it may have appeared in shell, process, proxy, or server logs.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: bin/run.mjs:68
Finding: API Token Exposed Through Process Arguments and URL Query Parameters
Content: View full analysis
parameter.name === "token"); if (!tokenParam || params.token !== undefined) { return; } if (!cliToken) { fail("--token is required for this operation.", { operationId: operation.operationId, }); } params.token = cliToken; } ``` ```javascript // bin/run.mjs:220-228 function applyQueryParams(operation, params, url) { for (const parameter of operation.parameters.filter((item) => item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } ``` ```bash # SKILL.md:43 node {baseDir}/bin/run.mjs --operation "ershoufangDetailV1" --token "$JUST_ONE_API_TOKEN" --params-json '{"cityId":"","houseCode":""}' ``` ### Technical Analysis The Skill requires an API token for its de ...[truncated 2652 chars]
Remediation: View remediation
","houseCode":""}' ``` 4. If the upstream API mandates query-string authentication, retain the token only in memory for the shortest practical time and document the residual risk. Configure clients, gateways, proxies, application servers, monitoring platforms, and error handlers to redact the `token` query parameter. 5. Never include the completed request URL, request headers, token value, or complete process invocation in diagnostic output. Add automated tests confirming that errors and logs do not contain a supplied sentinel token. 6. Rotate any token suspected of appearing in process, shell, gateway, proxy, or server logs, and restrict token permissions and quotas to the minimum needed for this endpoint. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill invokes a network-capable helper (node {baseDir}/bin/run.mjs) to call an external API, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates a policy gap where a host or reviewer cannot easily constrain or audit the skill's external communication behavior, increasing the risk of unintended or over-broad network access if the runtime grants default capabilities.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill defines the authentication token as a query parameter and later appends all query parameters directly into the URL. Query-string tokens are commonly exposed through logs, browser history, proxy/CDN logs, monitoring systems, referrer leakage, and error messages, making credential disclosure more likely than with header-based authentication. In this API-wrapper context, the risk is real because the code is explicitly designed to transmit the token this way on every request.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.