Bilibili Video Captions API

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:43 AM UTC
• Version: 1.0.0

Overview

The skill appears to call the stated Bilibili captions API, but it handles the required API token in ways that can expose it through process arguments and URL logs.

Review before installing. Use a least-privilege, revocable JustOneAPI token, avoid shared machines or verbose process monitoring, and rotate the token if it may appear in process listings, diagnostics, proxy logs, or API access logs. The concern is credential exposure, not evidence of hidden exfiltration or destructive behavior.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: bin/run.mjs:24

Finding

API Token Exposed Through Command-Line Arguments and URL Query Parameters

Content

View full analysis

Vulnerability Details

File Location: bin/run.mjs:24-32, 88-90, 221-229; SKILL.md:43,49; generated/operations.json:16-24; generated/operations.md:19
Vulnerability Type: API credential exposure
Risk Level: Medium

The Skill accepts the JustOneAPI access token as a command-line argument and transmits it as a URL query parameter.

Relevant parameter definition from bin/run.mjs:24-32:

js

      {
        "defaultValue": null,
        "description": "Access token for the API.",
        "enumValues": [],
        "location": "query",
        "name": "token",
        "required": true,
        "schemaType": "string"
      },

Request construction and transmission from bin/run.mjs:88-90:

js

applyPathParams(operation, params, url);
applyQueryParams(operation, params, url);

Token injection from bin/run.mjs:221-229:

js

function injectToken(operation, params, cliToken) {
  const tokenParam = operation.parameters.find((parameter) => parameter.name === "token");
  if (!tokenParam || params.token !== undefined) {
    return;
  }
  if (!cliToken) {
    fail("--token is required for this operation.", {
      operationId: operation.operationId,
    });
  }
  params.token = cliToken;
}

The documented invocation in SKILL.md:43 also places the credential in the process argument list:

bash

node {baseDir}/bin/run.mjs --operation "getVideoCaptionV1" --token "$JUST_ONE_API_TOKEN" --params-json '{"bvid":"<bvid>","aid":"<aid>","cid":"<cid>"}'

Technical Analysis

Passing a secret through --token can expose its value through process inspection facilities, command auditing, shell tracing, diagnostic tooling, or process-monitoring systems. Although shell expansion does not normally place the expanded value in shell history when the command contains the environment-variable reference, the resulting Node.js process still recei ...[truncated 2431 chars]

Remediation

View remediation

Remediation Suggestions

1. Read the credential directly from process.env.JUST_ONE_API_TOKEN rather than requiring it through --token. This prevents routine exposure in the Node.js process argument vector.

2. Update the API integration to send the token in a dedicated authorization header, if supported by JustOneAPI:

   js

   const token = process.env.JUST_ONE_API_TOKEN;
   if (!token) {
     fail("JUST_ONE_API_TOKEN is required.");
   }
   
   const requestInit = {
     method: operation.method,
     headers: {
       accept: "application/json",
       authorization: `Bearer ${token}`,
     },
   };
   

3. Remove the token from the operation's query-parameter definition and prevent callers from supplying token through --params-json.

4. Remove the --token option from the documented command and runtime argument parser.

5. Ensure request URLs, headers, and configuration objects are redacted before being written to logs, traces, diagnostics, or error reports.

6. If JustOneAPI only supports query-string authentication, continue reading the token from the environment, never print or log the resulting URL, configure all intermediary systems to redact the token parameter, and explicitly document the residual query-string exposure risk.

7. Rotate any token that may already have appeared in process monitoring or URL logs, and review those systems for unauthorized retention or access.

8. Apply least-privilege restrictions, expiration, usage limits, and revocation controls to issued API tokens wherever supported.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

This finding is substantiated by the code path: the declared access token parameter is not merely documented, it is automatically injected and transmitted in the URL query string. That creates a practical credential exposure issue because secrets in URLs are easier to capture in infrastructure logs, telemetry, reverse proxies, and support traces than header-based secrets. The skill context does not justify handling credentials this way; it makes the issue more dangerous because this is a reusable integration wrapper likely to be invoked repeatedly with live tokens.

Content

Scanner excerpt · bin/run.mjs (reported line 20)May include surrounding context.

js

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for the API.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The operation explicitly requests an access token, which is a credential, and the token is supplied as a query parameter. In this context the danger is elevated because the skill brokers access through an external API service, so compromised or over-scoped tokens could enable unauthorized API use, billing abuse, or data access, and query-param handling further increases leakage risk.

Content

Scanner excerpt · generated/operations.json (reported line 15)May include surrounding context.

json

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for the API.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · generated/operations.md (reported line 19)May include surrounding context.

md

| Name | In | Required | Type | Default | Description |
| --- | --- | --- | --- | --- | --- |
| `token` | `query` | yes | `string` | n/a | Access token for the API. |
| `bvid` | `query` | yes | `string` | n/a | Bilibili Video ID (BVID). |
| `aid` | `query` | yes | `string` | n/a | Bilibili AID. |
| `cid` | `query` | yes | `string` | n/a | Bilibili CID. |

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill invokes a network-capable helper (node .../bin/run.mjs) to call an external API, but the manifest does not explicitly declare tool scope such as permissions or allowed-tools. This creates a least-privilege and transparency gap: an agent runtime or reviewer cannot easily constrain or audit the skill’s external communication behavior from the manifest alone.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill defines the API access token as a query parameter and later appends all query parameters into the request URL. Query-string secrets are commonly exposed via logs, monitoring systems, browser/history tooling, proxy layers, and error messages, which increases the chance of credential leakage beyond the intended recipient. In this skill context, the token is for a third-party API and is required for every call, so the exposure path is real and recurring.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest requires an API access token as a query parameter but does not warn users that credentials are being transmitted to an external third-party service. Query-string tokens are particularly risky because they are often logged by clients, proxies, servers, and observability systems, increasing the chance of credential exposure.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This is a manifest-style JSON file, so vague-trigger review applies. The description states what the skill does but does not define any explicit trigger phrases, activation boundaries, or negative examples, which can make invocation scope ambiguous in systems that derive routing from manifest descriptions.

Content

No source excerpt is available for this finding.