Douban Movie Review Details API

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:02 AM UTC
• Version: 1.0.0

Overview

This skill is a focused Douban review lookup, but it handles the JustOneAPI token in ways that can expose credentials through command arguments and request URLs.

Review before installing if the API token has billing, quota, or account-level impact. Prefer a short-lived or restricted JustOneAPI token, rotate it if exposed, and be aware that this skill's normal invocation can place the token in process arguments and request URLs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: bin/run.mjs:214

Finding

API Credential Exposure Through Process Arguments and URL Query Parameters

Content

View full analysis

parameter.name === "token"); if (!tokenParam || params.token !== undefined) { return; } if (!cliToken) { fail("--token is required for this operation.", { operationId: operation.operationId, }); } params.token = cliToken; } ``` The documented invocation also passes the secret through a command-line argument: ```bash node {baseDir}/bin/run.mjs --operation "getMovieReviewDetailsV1" --token "$JUST_ONE_API_TOKEN" --params-json '{"reviewId":""}' ``` ## ...[truncated 2928 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

This skill explicitly requests an access token, which creates credential-handling risk, and in this implementation the token is passed in the URL query string. That combination increases exposure risk substantially because credentials may be captured in logs or reused if leaked, potentially enabling unauthorized access to the API service.

Content

Scanner excerpt · generated/operations.json (reported line 15)May include surrounding context.

json

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bin/run.mjs (reported line 20)May include surrounding context.

js

| Name | In | Required | Type | Default | Description |
| --- | --- | --- | --- | --- | --- |
| `token` | `query` | yes | `string` | n/a | Access token for this API service. |
| `reviewId` | `query` | yes | `string` | n/a | The unique ID for a specific review on Douban. |

### Request body

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · generated/operations.md (reported line 19)May include surrounding context.

md

| Name | In | Required | Type | Default | Description |
| --- | --- | --- | --- | --- | --- |
| `token` | `query` | yes | `string` | n/a | Access token for this API service. |
| `reviewId` | `query` | yes | `string` | n/a | The unique ID for a specific review on Douban. |

### Request body

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill invokes a network-capable helper (node .../bin/run.mjs) and is explicitly designed to call an external API, but it does not declare any permissions or allowed-tools scope. That creates a governance gap: the agent may be allowed to make outbound requests without an explicit, reviewable tool boundary, increasing the chance of unintended data egress or misuse of the provided API token.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill defines the API access token as a query parameter and automatically appends it to the URL. Query-string credentials are commonly exposed through logs, proxies, browser/history artifacts, monitoring systems, and error telemetry, which increases the chance of credential leakage even when HTTPS is used.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill requires an access token to be sent as a query parameter, which is unsafe because query strings are commonly logged by clients, proxies, gateways, browser histories, and observability systems. The manifest also provides no user-facing warning or disclosure, increasing the chance that sensitive credentials are exposed unintentionally during normal use.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This manifest-style JSON describes the skill's purpose but does not specify when it should or should not be invoked, nor does it provide any explicit trigger phrases or exclusions. For manifest files, that broadness can create ambiguous activation conditions if a dispatcher relies on description text to decide when to call the skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.