Douyin (TikTok China) Video Comments API

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:06 AM UTC
• Version: 1.0.0

Overview

The skill appears to call the advertised Douyin comments API, but it handles the JustOneAPI token in ways that can expose it unnecessarily.

Review before installing. Use a limited-scope JustOneAPI token, avoid running the command in places that log process arguments, and assume the token may appear in service or proxy URL logs unless the provider changes authentication to a header-based scheme. Handle returned comment data as user-generated content that may require privacy and platform-terms care.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: bin/run.mjs:29

Finding

API Credential Exposed Through URL Query Parameters and Process Arguments

Content

View full analysis

item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } ``` The documented invocation explicitly passes the token as a command-line argument: ```bash node {baseDir}/bin/run.mjs --operation "getVideoCommentV1" --token "$JUST_ONE_API_TOKEN" --params-json '{"awemeId":""}' ` ...[truncated 2464 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The skill requires an API access token and sends it as a URL query parameter. Query-string credentials are dangerous because they are commonly logged by client tooling, proxies, gateways, browser/history systems, and server access logs, which can expose the token to unintended parties. In this skill context, the script directly appends the token to the request URL, so normal operation leaks a secret into locations that are harder to control than headers.

Content

Scanner excerpt · bin/run.mjs (reported line 20)May include surrounding context.

js

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 81% confidence

Finding

The presence of an access token parameter indicates the skill handles credentials, and in this case the credential is collected in a query parameter rather than a safer channel. The skill context is an external API connector, so credential use is expected, but the implementation choice makes accidental exposure more likely than necessary.

Content

Scanner excerpt · generated/operations.json (reported line 15)May include surrounding context.

json

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · generated/operations.md (reported line 19)May include surrounding context.

md

| Name | In | Required | Type | Default | Description |
| --- | --- | --- | --- | --- | --- |
| `token` | `query` | yes | `string` | n/a | Access token for this API service. |
| `awemeId` | `query` | yes | `string` | n/a | The unique video identifier (aweme_id). |
| `page` | `query` | no | `integer` | `1` | Page number (starting from 1). |

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill invokes a network-capable helper (node .../bin/run.mjs) that can call a third-party API, but it does not declare an explicit tool scope such as permissions or allowed-tools. This weakens policy enforcement and transparency because an agent may be able to make outbound requests without a clear, least-privilege declaration of what capabilities the skill requires.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill requires an API access token to be sent as a URL query parameter, which is commonly exposed through logs, browser history, proxy caches, analytics systems, and referrer leakage. Even if the upstream API supports this design, embedding it in a skill without warning or safer handling increases the chance of credential disclosure to unintended parties.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The skill is designed to retrieve third-party social media comments, which may contain personal data, sensitive opinions, or other regulated content, yet the description provides no user-facing warning about privacy or handling expectations. This increases the chance of accidental collection, display, or downstream processing of sensitive data without informed user consent or safe-handling guidance.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The description states that the operation retrieves comment authors, text, and likes for analysis, which involves collecting and processing user-generated content. The markdown does not include any user-facing warning about privacy, consent, or responsible handling of this data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.