Security audit

Bilibili Video Danmaku API

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to do the advertised Bilibili danmaku lookup, but it handles the API token in leak-prone ways that users should review first.

Install only if you are comfortable sending a JustOneAPI token to api.justoneapi.com and with that token appearing in the request URL and process arguments. Prefer a version that sends credentials in an Authorization header or otherwise avoids query-string and argv exposure, and rotate the token if it may have been logged.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: bin/run.mjs:222
Finding: API Credential Transmitted in URL Query Parameters
Content: View full analysis
item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } ``` The generated API definitions confirm the same authentication design in `generated/operations.json:16-24` and `generated/operations.md:19`. ### Technical Analysis The helper deliberately appends the JustOneAPI access token to the URL query string before calling the fixed HTTPS endpoint. HTTPS protects the request from passive interception while in transit, but it does not prevent the complete URL from being recorded at either endpoint or by infrastructure processing the request. Query strings are commonly captured by: - Reverse-proxy and web-server access logs - API gateway logs - Network observability and tracing systems - Error reports and request diagnostics - Browser or request histories in some calling contexts - Monitoring systems that record request URLs The network call itself is necessary for the Skill's declared functionality and is restricted to the hardcoded `https://api.justoneapi.com` origin. No user-controlled destination or covert exfiltration endpoint was identified. Nevertheless, placing an access credential in the URL creates an avoidable exposure channel and does no ...[truncated 1404 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: bin/run.mjs:140
Finding: API Credential Exposed Through Process Command-Line Arguments
Content: View full analysis
","cid":""}' ``` The helper explicitly accepts and stores the token from the process arguments: ```js function parseArgs(argv) { const parsed = { operation: null, paramsJson: "{}", token: null }; for (let index = 0; index < argv.length; index += 1) { const flag = argv[index]; const value = argv[index + 1]; if (flag === "--operation") { parsed.operation = value; index += 1; continue; } if (flag === "--params-json") { parsed.paramsJson = value; index += 1; continue; } if (flag === "--token") { parsed.token = value; index += 1; continue; } fail(`Unknown argument "${flag}".`); } return parsed; } ``` ### Technical Analysis Although the shell variable is correctly quoted, the shell expands `$JUST_ONE_API_TOKEN` before starting Node.js. The resulting secret is therefore present in the child process's argument vector. Depending on operating-system configuration and deployment tooling, process arguments may be observable through: - Process inspection utilities - Process accounting or audit systems - Container orchestration metadata - Endpoint monitoring and telemetry - Crash diagnostics - Command execution logs The Skill already declares `JUST_ONE_API_TOKEN` as a required environment variable, so copying it into `argv` is unnecessary. Reading the credential directly from `process.env` would reduce exposure while preserving the declared functionality. ### Attack Path 1. The user follows the command documented in `SKILL.md`. 2. The ...[truncated 1061 chars]
Remediation: View remediation
","cid":""}' ``` 4. For higher-security deployments, support token input through a protected file descriptor, standard input, or a platform credential manager. 5. Ensure application and orchestration logs do not record environment contents or complete command lines containing legacy credentials. 6. Rotate tokens that may have been captured by process monitoring or command audit systems. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Credential Access

High

Category: Privilege Escalation
Confidence: 97% confidence
Finding: The skill defines an access token as a query parameter and injects it into the request URL, which exposes the credential in places URLs are commonly logged or retained, such as client logs, proxies, browser/history equivalents, and upstream server access logs. While the code does not itself exfiltrate the token beyond making the intended API call, transmitting secrets in the query string is an unsafe credential-handling pattern that increases risk of accidental disclosure.
Content: Scanner excerpt · bin/run.mjs (reported line 20)May include surrounding context.
js
"parameters": [ { "defaultValue": null, "description": "Access token for the API.", "enumValues": [], "location": "query", "name": "token",

Credential Access

High

Category: Privilege Escalation
Confidence: 97% confidence
Finding: This operation explicitly requests an access token, which is a credential, and places it in a request parameter rather than isolating it in a secure auth scheme. If mishandled, leaked, or reused, the token could allow unauthorized use of the external API account, quota consumption, or access to associated paid or restricted resources.
Content: Scanner excerpt · generated/operations.json (reported line 15)May include surrounding context.
json
"parameters": [ { "defaultValue": null, "description": "Access token for the API.", "enumValues": [], "location": "query", "name": "token",

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · generated/operations.md (reported line 19)May include surrounding context.
md
| Name | In | Required | Type | Default | Description | | --- | --- | --- | --- | --- | --- | | `token` | `query` | yes | `string` | n/a | Access token for the API. | | `aid` | `query` | yes | `string` | n/a | Bilibili Archive ID (AID). | | `cid` | `query` | yes | `string` | n/a | Bilibili Chat ID (CID). | | `page` | `query` | no | `string` | n/a | Page number for pagination. |

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest requires an API token to be sent as a query parameter to an external service, but provides no warning that credentials will be transmitted off-platform. Query parameters are commonly exposed in logs, browser history, proxies, analytics systems, and server access logs, increasing the chance of credential leakage beyond the intended recipient.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This is a manifest-style JSON file, so vague-trigger review applies. The description explains what the skill does but provides no specific invocation phrases, constraints, or negative examples, which can make activation conditions ambiguous in agent routing.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file describes an API operation requiring a token query parameter, but it does not include any warning about handling credentials or the privacy implications of transmitting them in requests. For markdown files, omitting warnings about behaviors that could affect user privacy or credential safety is in scope.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.