Security audit

Douyin E-commerce Item Details API

Security checks for vulnerabilities and agentic risk

Overview

This skill does the advertised Douyin item-detail lookup, but it handles the API token in ways that can expose it through URLs and process arguments.

Install only if you are comfortable giving this skill a JustOneAPI token and with the token potentially appearing in process listings or request URLs. Prefer a narrowly scoped, low-privilege, regularly rotated token, and avoid running it in environments that capture command lines or full URLs in logs.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: bin/run.mjs:18
Finding: API Token Exposed Through URL Query Parameters
Content: View full analysis
item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } ``` ### Technical Analysis The operation defines the API token as a query parameter. `applyQueryParams` subsequently inserts that token into the URL before the request is sent to the declared HTTPS endpoint. HTTPS protects the URL while it is transmitted over the network, but it does not prevent the complete URL from being recorded by the API server, reverse proxies, gateways, monitoring platforms, diagnostic tooling, or access logs. Query strings may also receive weaker redaction treatment than authorization headers. The network request is necessary for the Skill's declared functionality, and the destination is statically restricted to `https://api.justoneapi.com`. No evidence was found that the token is intentionally transmitted to an unrelated host. Nevertheless, placing the credential in the URL exposes it more broadly than necessary. ### Attack Path 1. A user invokes the Skill with a valid JustOneAPI token. 2. The runner assigns the token to the operation's `token` parameter. 3. `applyQueryParams` constructs a URL containing `?token=`. 4. A reverse proxy, API gateway, server access logger, telemetry system, or ...[truncated 677 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: bin/run.mjs:144
Finding: API Token Exposed Through Process Command-Line Arguments
Content: View full analysis
"}' ``` ```js if (flag === "--token") { parsed.token = value; index += 1; continue; } ``` The documentation further instructs users to pass the secret through the command line: ```md - Required: `JUST_ONE_API_TOKEN` - Pass the token with `--token "$JUST_ONE_API_TOKEN"`; do not paste token values into chat messages, screenshots, or logs. ``` ### Technical Analysis Although the token originates in an environment variable, shell expansion places its value directly into the Node process argument vector. Depending on operating-system permissions and runtime monitoring, command-line arguments may be observable through process inspection, audit systems, orchestration metadata, command-capture telemetry, or crash diagnostics. The documentation's warning against pasting tokens into logs does not prevent this exposure because the documented invocation itself expands the secret into `argv`. The runner does not print the token directly, but accepting it through `--token` unnecessarily increases its exposure. ### Attack Path 1. A user follows the documented command and supplies `--token "$JUST_ONE_API_TOKEN"`. 2. The shell expands the environment variable before starting Node. 3. The resulting process argument vector contains the plaintext token. 4. A local user or monitoring component with sufficient process-inspection access observes or records the command line while the runner is active. 5. The observer extracts the token and reuses it against JustOneAPI. This path requires access to process information, audit records, or equivalent telemetry; the issue does not grant that access by itself. ### Imp ...[truncated 466 chars]
Remediation: View remediation
"}' ``` 5. Ensure error messages, crash handlers, and telemetry never serialize the environment value. 6. Use short-lived, narrowly scoped tokens and rotate any token suspected of appearing in process or audit records. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Credential Access

High

Category: Privilege Escalation
Confidence: 92% confidence
Finding: This finding is supported by the explicit handling of an access token and its placement in the query string, which increases the chance of credential exposure across intermediaries and operational logs. In the context of a reusable agent skill, this is more dangerous because tokens may be supplied automatically and reused across workflows, broadening the blast radius if leaked.
Content: Scanner excerpt · bin/run.mjs (reported line 20)May include surrounding context.
js
"parameters": [ { "defaultValue": null, "description": "Access token for this API service.", "enumValues": [], "location": "query", "name": "token",

Credential Access

High

Category: Privilege Escalation
Confidence: 88% confidence
Finding: The presence of an access token field is not inherently malicious, but here it is coupled with insecure placement in the query string, creating a realistic credential exposure risk. The skill context is a third-party e-commerce API wrapper, so the token may traverse multiple services, making accidental disclosure more likely if request URLs are stored or monitored.
Content: Scanner excerpt · generated/operations.json (reported line 15)May include surrounding context.
json
"parameters": [ { "defaultValue": null, "description": "Access token for this API service.", "enumValues": [], "location": "query", "name": "token",

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · generated/operations.md (reported line 19)May include surrounding context.
md
| Name | In | Required | Type | Default | Description | | --- | --- | --- | --- | --- | --- | | `token` | `query` | yes | `string` | n/a | Access token for this API service. | | `itemId` | `query` | yes | `string` | n/a | The unique ID of the item on Douyin E-commerce. | ### Request body

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill invokes a network-capable helper (node ... run.mjs) and uses an API token, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization gap where an agent or platform may allow broader-than-intended external access without clear policy boundaries, increasing the risk of unintended outbound requests or misuse of secrets during execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill defines the API token as a query parameter and later appends all query parameters directly to the request URL. Query-string credentials are commonly exposed in logs, browser/history tooling, proxy layers, monitoring systems, and error messages, making inadvertent credential disclosure significantly more likely than using an Authorization header.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill defines a required API access token as a query parameter, which is commonly exposed in logs, browser history, proxy caches, analytics systems, and referrer headers. In an agent/tooling context, this is more dangerous because intermediate platforms may record full request URLs, increasing the chance of credential leakage beyond the intended recipient.
Content: No source excerpt is available for this finding.