ClawHub
Back to skill

Security audit

Bilibili User Published Videos API

Security checks for vulnerabilities and agentic risk

Overview

This skill is a narrow JustOneAPI helper for fetching Bilibili user video lists, but users should treat its API token handling as sensitive.

Install only if you are comfortable sending a JustOneAPI token to api.justoneapi.com for this Bilibili lookup. Use a scoped, revocable token where possible, avoid sharing logs or process traces from runs, and rotate the token if it may have appeared in command-line telemetry or URL logs.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
bin/run.mjs:76
Finding

API Token Exposure Through Process Arguments and URL Query Parameters

Content
View full analysis
parameter.name === "token"); if (!tokenParam || params.token !== undefined) { return; } if (!cliToken) { fail("--token is required for this operation.", { operationId: operation.operationId, }); } params.token = cliToken; } ``` Because the manifest declares the token as a query parameter, it is appended to the request URL and transmitted: ```js const params = parseParams(args.paramsJson); applyDefaults(operation, params); injectToken(operation, params, args.token); validateRequired(operation, params); const baseUrl = manifest.baseUrl; const url = new URL(operation.path, ensureBaseUrl(baseUrl)); applyPathParams(operation, params, url); applyQueryParams(operation, params, url); const requestInit = { headers: { "accept": "application/json", }, method: operation.method, }; ...[truncated 3658 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Credential Access

High
Category
Privilege Escalation
Confidence
96% confidence
Finding

The operation explicitly requests an access token, which constitutes credential access by the skill. In this context the token is likely functionally necessary, but collecting and transmitting credentials to a third-party API is security-sensitive because compromise, logging, or misuse of that token could grant unauthorized API access and abuse of the user's account or quota.

Content

Scanner excerpt · generated/operations.json (reported line 15)May include surrounding context.

json
"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for the API.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bin/run.mjs (reported line 20)May include surrounding context.

js
| Name | In | Required | Type | Default | Description |
| --- | --- | --- | --- | --- | --- |
| `token` | `query` | yes | `string` | n/a | Access token for the API. |
| `uid` | `query` | yes | `string` | n/a | Bilibili User ID (UID). |
| `param` | `query` | no | `string` | n/a | Pagination parameter from previous response. |

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · generated/operations.md (reported line 19)May include surrounding context.

md
| Name | In | Required | Type | Default | Description |
| --- | --- | --- | --- | --- | --- |
| `token` | `query` | yes | `string` | n/a | Access token for the API. |
| `uid` | `query` | yes | `string` | n/a | Bilibili User ID (UID). |
| `param` | `query` | no | `string` | n/a | Pagination parameter from previous response. |

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill invokes a network-capable helper (node .../bin/run.mjs) and sends user-supplied query parameters plus an API token to an external service, but it does not declare any explicit tool scope such as allowed tools or permissions. This weakens policy enforcement and reviewability because an agent may be permitted to make outbound requests without a clearly bounded declaration of that capability.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This code requires a token and injects it into query parameters for the outbound request, which is a credential-handling and network transmission operation. While the code validates presence of the token, it provides no confirmation prompt, user-facing notice, or explanatory comment/docstring warning that sensitive credentials will be sent to a remote API.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill requires an API access token and sends it as a query parameter, but provides no user-facing warning about credential disclosure or handling. Query-string tokens are commonly exposed through logs, browser history, intermediary monitoring, and analytics systems, increasing the chance of credential leakage even when HTTPS is used.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

This JSON manifest describes what the skill does, but it does not specify any narrow activation conditions, invocation phrases, or exclusions. For manifest files, that lack of trigger specificity can make it unclear when the skill should activate versus when similar everyday requests about Bilibili videos should not invoke it.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.