Security audit

Beike Resale Housing List API

Security checks for vulnerabilities and agentic risk

Overview

This is a narrow housing-data API wrapper, but it needs review because its API token is passed through command-line arguments and URL query parameters that can leak into logs or process listings.

Install only if you are comfortable giving this skill a JustOneAPI token and having it call api.justoneapi.com for Beike listing data. Prefer a low-privilege or disposable token if available, monitor usage, and rotate the token if you suspect command-line process data or request URLs are logged.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: bin/run.mjs:229
Finding: Authentication Token Exposed Through URL Query String and Process Arguments
Content: View full analysis
item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } ``` ### Technical Analysis Because `token` has a location of `query`, `applyQueryParams` constructs a request URL equivalent to: ```text https://api.justoneapi.com/api/beike/get-ershoufang-list/v1?token=SECRET&cityId=110000&condition=&offset=0 ``` HTTPS encrypts the request while it is in transit, but it does not prevent the complete URL from being recorded at either endpoint or by trusted infrastructure. Query strings are commonly retained in reverse-proxy access logs, API gateway logs, observability platforms, debugging output, monitoring agents, and backend request logs. The documented invocation also supplie ...[truncated 1950 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill invokes a network-capable helper (node .../bin/run.mjs) and is explicitly designed to call an external API, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization and transparency gap: a host agent may permit networked execution without a clear least-privilege declaration, making unintended external requests or future skill changes harder to constrain and audit.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill transmits the user authentication token as a URL query parameter by treating token as a normal query parameter and then appending it in applyQueryParams. Query parameters are commonly exposed in logs, browser/history equivalents, reverse proxies, monitoring tools, crash reports, and upstream infrastructure, so this increases the chance of credential leakage even though the request uses HTTPS.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The natural-language fields in this manifest-like JSON are entirely English, including the user-facing description, summary, and parameter descriptions. For a housing-data skill tied to Chinese city IDs and the Beike platform, the file does not offer any language choice or explain why English-only presentation is required, which can conflict with a language/locale choice policy.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.