Security audit

Bilibili User Relation Stats API

Security checks for vulnerabilities and agentic risk

Overview

This is a narrow JustOneAPI helper for one Bilibili stats endpoint, with the main caution that its API token is passed through command-line arguments and the request URL.

Install only if you are comfortable giving this skill a JustOneAPI token for this endpoint. Prefer a short-lived or narrowly scoped token if available, rotate it if you suspect logs captured it, and be aware that this helper passes the token via --token and as a URL query parameter to api.justoneapi.com.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: bin/run.mjs:128
Finding: API Token Exposed Through Command-Line Arguments
Content: View full analysis
parameter.name === "token"); if (!tokenParam || params.token !== undefined) { return; } if (!cliToken) { fail("--token is required for this operation.", { operationId: operation.operationId, }); } params.token = cliToken; } ``` The documented invocation passes the environment variable through a command-line argument: ```bash node {baseDir}/bin/run.mjs --operation "getUserRelationStat" --token "$JUST_ONE_API_TOKEN" --params-json '{"wmid":""}' ``` ### Technical Analysis The shell expands `$JUST_ONE_API_TOKEN` before starting Node.js, placing the resulting secret in the process argument vector. Although the token is not printed directly by the Skill, command-line arguments can be exposed through process inspection, host telemetry, audit systems, crash diagnostics, debugging tools, or process-monitoring agents. This exposure is unnecessary because the Skill already declares `JUST_ONE_API_TOKEN` as its required environment variable. The executable could read that variable directly without copying its value into the process arguments. Exploitation requires local process-observation capability or access to telemetry that records command lines. This does not grant an unauthenticated remote attacker access by itself. ### Attack Path 1. A user invokes the Skill using the documented command and supplies the token through `--token "$JUST_ONE_API_TOKEN"`. 2. The shell expands the environment variable and includes the plaintext token in the Node.js process arguments. 3. An atta ...[truncated 749 chars]
Remediation: View remediation
"}' ``` 5. Ensure error messages, diagnostics, and telemetry never include the token. 6. Recommend revocation and rotation of tokens that may previously have been captured by process-monitoring or command-line telemetry. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: bin/run.mjs:183
Finding: API Token Transmitted in the URL Query String
Content: View full analysis
item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } ``` The resulting URL is sent directly: ```javascript response = await fetch(url, requestInit); ``` ### Technical Analysis The implementation constructs a request equivalent to: ```text https://api.justoneapi.com/api/bilibili/get-user-relation-stat/v1?token=SECRET&wmid=USER_ID ``` HTTPS protects the request URL from passive network observers during transit, and the destination is statically restricted to the documented `api.justoneapi.com` host. However, credentials placed in query strings are frequently retained by destination access logs, reverse proxies, API gateways, observability platforms, debugging systems, and error traces. Query-string authentication therefore increases credential persistence and the number of systems or operators that may gain access to the secret. Authentication headers are generally easier to identify and redact consistently. The transmission is necessary for the declared API operation only if the upstream JustOneAPI contract exclusively requires query-token authentication. The ...[truncated 1246 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · bin/run.mjs (reported line 20)May include surrounding context.
js
"parameters": [ { "defaultValue": null, "description": "Access token for the API.", "enumValues": [], "location": "query", "name": "token",

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · generated/operations.json (reported line 15)May include surrounding context.
json
"parameters": [ { "defaultValue": null, "description": "Access token for the API.", "enumValues": [], "location": "query", "name": "token",

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · generated/operations.md (reported line 19)May include surrounding context.
md
"parameters": [ { "defaultValue": null, "description": "Access token for the API.", "enumValues": [], "location": "query", "name": "token",

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill defines the API access token as a query parameter and later appends all query parameters directly into the URL. Query-string credentials are commonly exposed in logs, browser history, proxy caches, monitoring systems, and error telemetry, making accidental credential disclosure more likely even when HTTPS is used.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The API requires an access token to be sent as a query parameter, which is commonly exposed through browser history, intermediary proxy logs, analytics, referrer headers, and server access logs. Even over HTTPS, placing secrets in the URL increases the chance of accidental credential disclosure beyond the intended recipient.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.