Bilibili User Profile API

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:13 AM UTC
• Version: 1.0.0

Overview

This is a narrow Bilibili profile lookup wrapper with a real but disclosed token-handling risk, not hidden or destructive behavior.

Install only if you are comfortable sending a Bilibili UID and your JUST_ONE_API_TOKEN to JustOneAPI. Use a scoped, revocable token, avoid shell tracing or logging full commands, rotate the token if it may have appeared in logs, and do not use returned profile data for identity or trust decisions without proper consent and context.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: bin/run.mjs:22

Finding

API Token Exposed Through Command-Line Arguments and URL Query Parameters

Content

View full analysis

parameter.name === "token"); if (!tokenParam || params.token !== undefined) { return; } if (!cliToken) { fail("--token is required for this operation.", { operationId: operation.operationId, }); } params.token = cliToken; } ``` The documented invocation also passes the expanded secret as a command-line argument: ```bash node {baseDir}/bin/run.mjs --operation "getUserDetailV2" --token "$JUST_ONE_API_TOKEN" --params-json '{"uid":""}' ``` ### Technical Analysis The Skill legitimately requires an API credential to invoke its declared JustOneAPI endpoint. However, the chosen credential transport introduces two avoidable exposure channels. First, passing the token through `--token` places the expanded secret in the process argument vector. Depending on host configuration, command-line arguments can be ...[truncated 2500 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bin/run.mjs (reported line 20)May include surrounding context.

js

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for the API.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The API requires an access token as a query parameter, which is a risky credential-handling pattern because query strings are commonly logged by clients, proxies, servers, browser history, and observability tooling. If the token is exposed, an attacker could reuse it to access the third-party API and potentially any associated account capabilities.

Content

Scanner excerpt · generated/operations.json (reported line 15)May include surrounding context.

json

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for the API.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The skill is designed to collect and transmit an access token in a URL query parameter, which is a risky credential-handling pattern because query strings are commonly logged by clients, proxies, servers, browser history, and monitoring systems. Even if the endpoint is legitimate, exposing credentials this way can lead to token leakage and unauthorized API access.

Content

Scanner excerpt · generated/operations.md (reported line 19)May include surrounding context.

md

| Name | In | Required | Type | Default | Description |
| --- | --- | --- | --- | --- | --- |
| `token` | `query` | yes | `string` | n/a | Access token for the API. |
| `uid` | `query` | yes | `string` | n/a | Bilibili User ID (UID). |

### Request body

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill invokes a network-capable helper (node .../run.mjs) that sends user-supplied input and an API token to an external service, but it does not declare any explicit tool scope such as permissions or allowed-tools. This weakens sandboxing and reviewability because a host agent may not have a machine-readable restriction indicating that outbound network access is expected and permitted only for this API call.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill defines the API access token as a query parameter and automatically appends it to the request URL. Query-string secrets are commonly exposed through logs, proxies, browser/history artifacts, monitoring systems, and error messages, making credential leakage materially more likely than if the token were sent in an Authorization header.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The operation description explicitly frames the API as useful for 'verifying user identity and social presence,' which broadens the skill's apparent purpose from simple profile lookup into identity-related assessment. That kind of open-ended identity verification language can enable misuse for profiling, doxxing, or trust decisions without clear consent or scope limits.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest advertises access to identity-related profile fields and audience metrics but provides no warning that the data may be sensitive or that privacy considerations apply. In an agent setting, this omission can normalize collecting or exposing personal/profile information without informing users of the privacy implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The operation requires sending both an API access token and a user identifier to an external third-party endpoint, but the skill text does not warn the user that these values will be transmitted off-platform. This creates a transparency and consent problem and increases the risk of unintended disclosure of credentials or identifiers, especially if users assume the action is local or first-party.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.