ClawHub
Back to skill

Security audit

Bilibili Video Comments API

Security checks for vulnerabilities and agentic risk

Overview

This is a focused JustOneAPI wrapper for one Bilibili comments endpoint, with no hidden persistence or unrelated behavior, but its API token handling can expose the token in process and URL logs.

Install only if you are comfortable sending Bilibili video identifiers and receiving comment/profile data through JustOneAPI. Use a narrowly scoped or short-lived JustOneAPI token if available, avoid sharing logs that may contain command lines or full request URLs, and rotate the token if it may have appeared in logs.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
bin/run.mjs:27
Finding

API Token Exposure Through Process Arguments and URL Query Parameters

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:40; bin/run.mjs:27-35, 73-85, 142-146, 207-215; generated/operations.json:14-22; generated/operations.md:20
Vulnerability Type: Credential exposure through command-line arguments and URL query strings
Risk Level: Medium

Vulnerable Code

SKILL.md:40 instructs users to supply the token as a command-line argument:

bash
node {baseDir}/bin/run.mjs --operation "getVideoCommentV2" --token "$JUST_ONE_API_TOKEN" --params-json '{"aid":"<aid>"}'

bin/run.mjs:27-35 defines the credential as a required query parameter:

js
{
  "defaultValue": null,
  "description": "Access token for the API.",
  "enumValues": [],
  "location": "query",
  "name": "token",
  "required": true,
  "schemaType": "string"
}

bin/run.mjs:73-85 adds all query parameters, including the token, to the request URL and transmits it:

js
const baseUrl = manifest.baseUrl;
const url = new URL(operation.path, ensureBaseUrl(baseUrl));
applyPathParams(operation, params, url);
applyQueryParams(operation, params, url);

const requestInit = {
  headers: {
    "accept": "application/json",
  },
  method: operation.method,
};

bin/run.mjs:142-146 accepts the credential through the process argument list:

js
if (flag === "--token") {
  parsed.token = value;
  index += 1;
  continue;
}

bin/run.mjs:207-215 serializes every query parameter into the URL:

js
function applyQueryParams(operation, params, url) {
  for (const parameter of operation.parameters.filter((item) => item.location === "query")) {
    const value = params[parameter.name];
    if (value === undefined) {
      continue;
    }
    appendValue(url.searchParams, parameter.name, value);
  }
}

Technical Analysis

Authentication is necessary for the Skill's declared Bilibili comment-retrieval functionality, and the re ...[truncated 2338 chars]

Remediation
View remediation

Remediation Suggestions

  1. Read the token directly from process.env.JUST_ONE_API_TOKEN rather than requiring a --token argument. Remove or deprecate command-line token handling so the secret is not exposed in process listings.
  2. If supported by JustOneAPI, transmit the credential in an authorization header, such as:
    js
    const token = process.env.JUST_ONE_API_TOKEN;
if (!token) {
  fail("JUST_ONE_API_TOKEN is required.");
}

const requestInit = {
  method: operation.method,
  headers: {
    accept: "application/json",
    authorization: `Bearer ${token}`,
  },
};
  3. Remove token from the operation's query-parameter definitions and regenerate generated/operations.json and generated/operations.md from the corrected API specification.
  4. Ensure application, proxy, gateway, and telemetry logging redacts authorization data and any legacy token query parameter.
  5. If the backend only supports query-string authentication, use narrowly scoped, short-lived tokens, prohibit URL logging where operationally possible, and explicitly document the remaining credential-disclosure risk.
  6. Rotate any token suspected of having appeared in process, command, proxy, gateway, or access logs.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The operation requires an access token as a query parameter, which is a risky credential-handling pattern because query strings are commonly logged by clients, proxies, servers, and observability tools. If exposed, the token could be reused to access the external API and any associated data or quota.

Content

Scanner excerpt · generated/operations.json (reported line 15)May include surrounding context.

json
"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for the API.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bin/run.mjs (reported line 20)May include surrounding context.

js
| Name | In | Required | Type | Default | Description |
| --- | --- | --- | --- | --- | --- |
| `token` | `query` | yes | `string` | n/a | Access token for the API. |
| `aid` | `query` | yes | `string` | n/a | Bilibili Archive ID (AID). |
| `cursor` | `query` | no | `string` | n/a | Pagination cursor. |

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · generated/operations.md (reported line 19)May include surrounding context.

md
| Name | In | Required | Type | Default | Description |
| --- | --- | --- | --- | --- | --- |
| `token` | `query` | yes | `string` | n/a | Access token for the API. |
| `aid` | `query` | yes | `string` | n/a | Bilibili Archive ID (AID). |
| `cursor` | `query` | no | `string` | n/a | Pagination cursor. |

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill invokes a network-capable helper (node .../bin/run.mjs) and is explicitly designed to call an external API, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates a policy gap where an agent platform may permit broader-than-intended network access or fail to present clear consent and enforcement boundaries for external calls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill defines the API access token as a query parameter and later appends all query parameters directly into the URL. Query strings are commonly exposed through logs, browser history, proxies, monitoring systems, and error messages, so placing secrets there increases the chance of credential leakage even when HTTPS is used.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest does not disclose that user-supplied API tokens and retrieved comment/profile data are sent to a third-party external service (JustOneAPI). This creates a privacy and security transparency issue because an agent or user may unknowingly transmit credentials and potentially sensitive data outside the local trust boundary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The operation description omits any warning that the skill sends an access token plus comment and commenter profile data to an external third-party API. In an agent context, this can cause users or downstream systems to transmit credentials and personal data without informed consent, increasing privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

This JSON file describes the skill in broad functional terms but does not specify when it should or should not be invoked. For manifest files, missing specificity on trigger scope can increase the chance of unintended activation by generic matching against the description or display name.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.