Security audit

Douban Movie Comments API

Security checks for vulnerabilities and agentic risk

Overview

This is a focused JustOneAPI Douban comments connector, but it passes the API token through command-line arguments and URL query parameters, which can expose the credential in process metadata or logs.

Review before installing if you will use a real JustOneAPI token. Prefer a low-scope, revocable token, avoid shared machines or verbose process logging, and rotate the token if command histories, process telemetry, proxy logs, or API logs may expose full URLs or command arguments.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: bin/run.mjs:21
Finding: API Token Exposed Through URL Query Parameters and Command-Line Arguments
Content: View full analysis
parameter.name === "token"); if (!tokenParam || params.token !== undefined) { return; } if (!cliToken) { fail("--token is required for this operation.", { operationId: operation.operationId, }); } params.token = cliToken; } ``` ```js function applyQueryParams(operation, params, url) { for (const parameter of operation.parameters.filter((item) => item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } ``` The documented invocation also passes the secret through a command-line argument: ```bash node {baseDir}/bin/run.mjs --operation "getMovieCommentsV1" --token "$JUST_ONE_API_TOKEN" --params-json '{"subjectId":""}' ``` ### Technical Analysis The access token is transmitted as part of the URL query string. Although the des ...[truncated 2408 chars]
Remediation: View remediation
"}' ``` The implementation should then retrieve `JUST_ONE_API_TOKEN` directly from the environment and avoid exposing its value in errors, output, or diagnostics. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · bin/run.mjs (reported line 20)May include surrounding context.
js
"parameters": [ { "defaultValue": null, "description": "Access token for this API service.", "enumValues": [], "location": "query", "name": "token",

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · generated/operations.json (reported line 15)May include surrounding context.
json
"parameters": [ { "defaultValue": null, "description": "Access token for this API service.", "enumValues": [], "location": "query", "name": "token",

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · generated/operations.md (reported line 19)May include surrounding context.
md
"parameters": [ { "defaultValue": null, "description": "Access token for this API service.", "enumValues": [], "location": "query", "name": "token",

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill invokes a network-capable helper (node ... run.mjs calling a remote API) but does not declare any explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls because an agent or platform may permit broader execution/network behavior than users expect, making external data exfiltration or unintended outbound requests harder to govern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The code appends the API token as a query parameter, causing the credential to be embedded in the full request URL. Query-string secrets are commonly exposed through logs, browser or proxy history, monitoring systems, referrer leakage, and upstream infrastructure, so the token may be disclosed outside the intended trust boundary.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill requires an access token to be sent as a query parameter, which places the credential in the request URL. URLs are commonly logged by clients, proxies, gateways, browser history, monitoring systems, and server access logs, so the token can be exposed beyond its intended scope even when HTTPS is used. In this skill context, the danger is increased because the operation is an API connector that will routinely handle real credentials.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.