Beike API

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:00 AM UTC
• Version: 1.0.10

Overview

This skill is a straightforward Beike/JustOneAPI wrapper, with the main caution that its API token is sent as a URL query parameter.

Install only if you are comfortable using a JustOneAPI token with this Beike wrapper. Because the token is sent in the request URL query string, use a scoped or low-risk token if available, avoid logging full request URLs, and rotate the token if you suspect exposure.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: bin/run.mjs:184

Finding

API Authentication Token Exposed in URL Query String

Content

View full analysis

Vulnerability Details

File Location: bin/run.mjs:31-39, bin/run.mjs:83-91, bin/run.mjs:124-132, bin/run.mjs:184-197, and bin/run.mjs:328-336
Vulnerability Type: Credential exposure through URL query parameters
Risk Level: Medium

Vulnerable Code

The authentication token is defined as a query parameter for each supported operation:

js

{
  "defaultValue": null,
  "description": "User authentication token.",
  "enumValues": [],
  "location": "query",
  "name": "token",
  "required": true,
  "schemaType": "string"
}

The token is injected into the general parameter object before the request URL is constructed:

js

const params = parseParams(args.paramsJson);
applyDefaults(operation, params);
injectToken(operation, params, args.token);
validateRequired(operation, params);

const baseUrl = manifest.baseUrl;
const url = new URL(operation.path, ensureBaseUrl(baseUrl));
applyPathParams(operation, params, url);
applyQueryParams(operation, params, url);

The resulting URL, including the token, is transmitted to the fixed JustOneAPI endpoint:

js

let response;
try {
  response = await fetch(url, requestInit);
} catch (error) {
  fail("Network request failed.", {
    cause: error instanceof Error ? error.message : String(error),
    operationId: operation.operationId,
  });
}

Query parameters are serialized directly into the URL:

js

function applyQueryParams(operation, params, url) {
  for (const parameter of operation.parameters.filter((item) => item.location === "query")) {
    const value = params[parameter.name];
    if (value === undefined) {
      continue;
    }
    appendValue(url.searchParams, parameter.name, value);
  }
}

function appendValue(searchParams, name, value) {
  if (Array.isArray(value)) {
    for (const item of value) {
      appendValue(searchParams, name, item);

...[truncated 2726 chars]

Remediation

View remediation

Remediation Suggestions

1. Modify the API contract and client to transmit the token in an HTTP authorization header rather than in the URL:

   js

   const requestInit = {
     headers: {
       accept: "application/json",
       authorization: `Bearer ${args.token}`,
     },
     method: operation.method,
   };
   

2. Remove token from the operation query-parameter definitions and ensure it cannot be supplied through --params-json.

3. Avoid storing the credential in the general-purpose params object. Keep authentication data separate from ordinary user-controlled request parameters.

4. Configure API gateways, reverse proxies, application logs, telemetry systems, and exception handlers to redact authorization credentials and any legacy token query parameter.

5. If JustOneAPI only supports query-string authentication, use narrowly scoped, short-lived tokens; rotate existing tokens; disable URL query logging where possible; and apply explicit redaction before request metadata enters monitoring systems.

6. Document the residual credential-exposure risk if query-string authentication is an unavoidable provider requirement.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md

- Get a token from [Just One API Dashboard](https://dashboard.justoneapi.com/en/login?utm_source=clawhub.ai&utm_medium=referral&utm_campaign=justoneapi_beike&utm_content=project_link).
- Authentication details: [Just One API Usage Guide](https://docs.justoneapi.com/en/?utm_source=clawhub.ai&utm_medium=referral&utm_campaign=justoneapi_beike&utm_content=project_link).

## Output Rules

- Start with a plain-language answer tied to the Beike task the user asked for.
- Include the most decision-relevant fields from the selected endpoint before dumping raw JSON.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill invokes a Node helper that performs authenticated external API requests, but the manifest does not explicitly declare tool scope such as allowed network access or permissions. This creates a governance gap: an agent or reviewer cannot reliably constrain what tools or outbound access the skill is expected to use, increasing the risk of overbroad execution and unintended data egress.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill requires the authentication token to be sent as a query parameter and also injects it into the URL before issuing the request. Query-string tokens are commonly exposed via logs, browser/history layers, proxy telemetry, monitoring systems, crash reports, and upstream infrastructure, increasing the chance of credential leakage even when HTTPS is used. In this API-wrapper context, the issue is more dangerous because the token is a primary credential used on every request and the implementation provides no warning or safer alternative.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The operation documents an authentication token in the URL query string, which is commonly logged by browsers, proxies, web servers, analytics tools, and monitoring systems. Even though this is API documentation rather than executable code, it instructs integrators to transmit credentials in a less safe channel without any warning, increasing the likelihood of token exposure and replay by unauthorized parties.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This endpoint repeats the same insecure pattern of placing the authentication token in a query parameter. Reuse across multiple operations broadens the exposure surface because any system handling request URLs may capture valid credentials, and the lack of documentation warning normalizes unsafe usage for developers.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documented use of a token in the query string for this listing endpoint creates the same credential leakage risk through logs, caches, referrer propagation, and intermediary infrastructure. In this skill context, the risk is more concerning because the file is meant to guide agent/API integrations, so insecure documentation can directly propagate bad security practices into production workflows.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.