Douban Movie Recent Hot Tv API

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:13 AM UTC
• Version: 1.0.0

Overview

This is a narrow read-only JustOneAPI wrapper for one Douban TV endpoint, with the main caution that its API token is passed through command-line arguments and a URL query parameter.

Install only if you are comfortable using a JustOneAPI token with this wrapper. Prefer a low-privilege, revocable token, avoid pasting token values into chat or logs, and rotate the token if you suspect it appeared in process history or URL logs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: bin/run.mjs:139

Finding

API Token Exposure Through Command-Line Arguments and URL Query Parameters

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:36, SKILL.md:42, bin/run.mjs:20-28, bin/run.mjs:59-75, bin/run.mjs:139-143, bin/run.mjs:203-210
Vulnerability Type: Insecure credential handling
Risk Level: Medium

The Skill instructs users to supply the JustOneAPI token as a command-line argument. The implementation then inserts that credential into the URL query string sent to the declared API endpoint.

Relevant documentation:

bash

node {baseDir}/bin/run.mjs --operation "getRecentHotTvV1" --token "$JUST_ONE_API_TOKEN" --params-json '{"key":"value"}'

Relevant token parameter declaration:

javascript

{
  "defaultValue": null,
  "description": "Access token for this API service.",
  "enumValues": [],
  "location": "query",
  "name": "token",
  "required": true,
  "schemaType": "string"
}

Relevant request construction:

javascript

const params = parseParams(args.paramsJson);
applyDefaults(operation, params);
injectToken(operation, params, args.token);
validateRequired(operation, params);

const baseUrl = manifest.baseUrl;
const url = new URL(operation.path, ensureBaseUrl(baseUrl));
applyPathParams(operation, params, url);
applyQueryParams(operation, params, url);

const requestInit = {
  headers: {
    "accept": "application/json",
  },
  method: operation.method,
};

Relevant command-line argument handling:

javascript

if (flag === "--token") {
  parsed.token = value;
  index += 1;
  continue;
}

Relevant query-string construction:

javascript

function applyQueryParams(operation, params, url) {
  for (const parameter of operation.parameters.filter((item) => item.location === "query")) {
    const value = params[parameter.name];
    if (value === undefined) {
      continue;
    }
    appendValue(url.searchParams, parameter.name, value);
  }
}

Technical Analysis

Supplying a secret ...[truncated 2699 chars]

Remediation

View remediation

Remediation Suggestions

1. Read the token directly from process.env.JUST_ONE_API_TOKEN instead of requiring a --token command-line argument:

   javascript

   const token = process.env.JUST_ONE_API_TOKEN;
   if (!token) {
     fail("JUST_ONE_API_TOKEN is required.", {
       operationId: operation.operationId,
     });
   }
   

2. Remove or deprecate the --token option so credentials are not exposed through process arguments or copied into shell history.

3. If supported by JustOneAPI, transmit the credential in an authorization header rather than the query string:

   javascript

   const requestInit = {
     headers: {
       accept: "application/json",
       authorization: `Bearer ${token}`,
     },
     method: operation.method,
   };
   

4. Prevent token from being accepted through --params-json. Treat authentication material separately from ordinary endpoint parameters.

5. If the upstream API only supports query-string authentication, document the residual exposure and ensure the API server, reverse proxies, gateways, monitoring systems, and error-reporting services redact the token query parameter.

6. Never include complete request URLs containing credentials in exceptions, logs, telemetry, or diagnostic output.

7. Apply server-side least privilege by restricting the token to the required endpoint and account scope where the service supports such controls. Use short-lived credentials and rotate any token suspected of appearing in process records or URL logs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bin/run.mjs (reported line 20)May include surrounding context.

js

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · generated/operations.json (reported line 15)May include surrounding context.

json

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · generated/operations.md (reported line 19)May include surrounding context.

md

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill invokes a Node helper that performs an authenticated network request, but the manifest does not declare an explicit tool scope such as allowed-tools or permissions. This creates a policy gap: execution environments or reviewers cannot reliably constrain or audit the network capability from the skill declaration, increasing the risk of unintended outbound requests or privilege expansion if the helper is modified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill defines the API token as a query parameter and injects it into the request URL, which exposes the credential in places where URLs are commonly logged or retained, such as proxy logs, browser/history equivalents, monitoring systems, and error traces. Although the request is sent over HTTPS, putting secrets in the query string still increases accidental disclosure risk compared with using an Authorization header or other secret-safe transport.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.