Douban Movie Recent Hot Movie API

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:43 AM UTC
• Version: 1.0.0

Overview

This is a focused movie-data API wrapper, but it handles the required API token in ways that can expose it through command arguments and request URLs.

Install only if you are comfortable providing a JustOneAPI token to api.justoneapi.com. Use a narrowly scoped, revocable token if possible, avoid running it on shared systems where process arguments may be visible, and rotate the token if command logs or URL logs may capture it.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: bin/run.mjs:20

Finding

API Token Exposed Through Process Arguments and URL Query Parameters

Content

View full analysis

parameter.name === "token"); if (!tokenParam || params.token !== undefined) { return; } if (!cliToken) { fail("--token is required for this operation.", { operationId: operation.operationId, }); } params.token = cliToken; } ``` ### Technical Analysis The documented invocation passes `JUST_ONE_API_TOKEN` through the `--token` command-line argument. Depending on the operating system and execution environment, command-line arguments may be visible through process inspection facilities, shell tracing, job-control systems, audit telemetry, or orchestration logs. The operation metadata declares the token as a query parameter. After `injectToken` places the secret in `params.token`, `applyQueryParams` appends it to the request URL. Although the request uses HTTPS and the destination is fixed to the declared `api.justoneapi.com` service, HTTPS does not prevent q ...[truncated 1961 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The skill requires an access token and sends it as a URL query parameter on a GET request. Query parameters are commonly exposed in logs, browser histories, proxy records, monitoring systems, and error traces, which increases the chance of credential leakage beyond the intended recipient. In this skill context, the code is a simple API wrapper and not overtly malicious, but placing credentials in the URL is still an insecure design choice.

Content

Scanner excerpt · bin/run.mjs (reported line 20)May include surrounding context.

js

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The API requires an access token to be sent as a query parameter, which is an unsafe credential transport pattern. Query parameters are commonly exposed in logs, browser history, analytics, referrers, and intermediary infrastructure, increasing the risk of token leakage and unauthorized reuse if the token is captured.

Content

Scanner excerpt · generated/operations.json (reported line 15)May include surrounding context.

json

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · generated/operations.md (reported line 19)May include surrounding context.

md

| Name | In | Required | Type | Default | Description |
| --- | --- | --- | --- | --- | --- |
| `token` | `query` | yes | `string` | n/a | Access token for this API service. |
| `page` | `query` | no | `integer` | `1` | Page number for pagination. |

### Request body

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill invokes a network-capable helper (node ... run.mjs) and requires an API token, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates an authorization gap where a hosting agent may permit broader tool use than intended or fail to present clear consent boundaries for outbound requests and secret use.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This JSON manifest describes the skill in general terms but does not define any specific trigger phrases, scope limits, or negative examples for when it should or should not activate. For a manifest file, that ambiguity can cause overly broad matching or unintended invocation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.