Douyin (TikTok China) Video Details API

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:11 AM UTC
• Version: 1.0.0

Overview

This skill is a focused wrapper for one documented JustOneAPI Douyin video-detail endpoint, with a real but disclosed token-handling risk.

Install only if you are comfortable using a JustOneAPI token for this endpoint. Prefer running it in an environment where process arguments and full request URLs are not logged, avoid pasting tokens into chat or logs, and rotate the token if it may have been exposed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: bin/run.mjs:19

Finding

API Token Exposed Through Process Arguments and URL Query Parameters

Content

View full analysis

Vulnerability Details

File Location: bin/run.mjs:19-27, 69-86, 159-171, 208-217; SKILL.md:39, 46
Vulnerability Type: Sensitive credential exposure
Risk Level: Medium

The Skill legitimately requires a JustOneAPI token and sends requests only to the fixed, documented HTTPS endpoint. However, the token is supplied through a command-line argument and subsequently placed in the request URL's query string.

Complete Code Snippets

SKILL.md:39 documents passing the secret as a command-line argument:

bash

node {baseDir}/bin/run.mjs --operation "getDouyinVideoDetailV2" --token "$JUST_ONE_API_TOKEN" --params-json '{"videoId":"<videoId>"}'

bin/run.mjs:19-27 defines the token as a query parameter:

javascript

{
  "defaultValue": null,
  "description": "Access token for this API service.",
  "enumValues": [],
  "location": "query",
  "name": "token",
  "required": true,
  "schemaType": "string"
},

bin/run.mjs:69-86 constructs the URL and sends the request:

javascript

const baseUrl = manifest.baseUrl;
const url = new URL(operation.path, ensureBaseUrl(baseUrl));
applyPathParams(operation, params, url);
applyQueryParams(operation, params, url);

const requestInit = {
  headers: {
    "accept": "application/json",
  },
  method: operation.method,
};

if (operation.requestBody && params.body !== undefined) {
  requestInit.body = JSON.stringify(params.body);
  requestInit.headers["content-type"] = operation.requestBody.contentType || "application/json";
}

let response;
try {
  response = await fetch(url, requestInit);

bin/run.mjs:159-171 accepts the token from the command line:

javascript

function parseArgs(argv) {
  const parsed = { operation: null, paramsJson: "{}", token: null };
  for (let index = 0; index < argv.length; index += 1) {
    const flag = argv[index];
    const value = argv[index + 1];
   
...[truncated 3221 chars]

Remediation

View remediation

Remediation Suggestions

1. Read the token directly from process.env.JUST_ONE_API_TOKEN instead of requiring a --token command-line argument:

   javascript

   const token = process.env.JUST_ONE_API_TOKEN;
   if (!token) {
     fail("JUST_ONE_API_TOKEN is required.");
   }
   

2. Prefer a standard authentication header if supported by JustOneAPI:

   javascript

   const requestInit = {
     method: operation.method,
     headers: {
       accept: "application/json",
       authorization: `Bearer ${token}`,
     },
   };
   

3. Remove the token from the operation's query-parameter collection so generic query construction cannot accidentally append it to the URL.
4. If the upstream service only supports query-string authentication, document this residual risk and configure clients, proxies, gateways, monitoring platforms, and access logs to redact the token parameter.
5. Ensure failures and diagnostics never print the complete request URL or serialized parameter object.
6. Rotate any token suspected of appearing in process accounting, logs, screenshots, shell history, or diagnostic records.
7. Restrict token permissions and quotas to the minimum API scope required for the video-detail operation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

This finding corresponds to the same underlying issue: the code treats a sensitive access token as a normal input parameter and sends it as part of the URL query. That practice increases the chance of credential exposure through operational telemetry and downstream systems rather than direct code execution, but it is still a real secret-handling weakness.

Content

Scanner excerpt · bin/run.mjs (reported line 20)May include surrounding context.

js

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The API requires an access token to be sent as a query parameter, which is an insecure pattern because query strings are commonly logged by clients, proxies, gateways, browser history, and observability tooling. If the token is exposed through logs or URL capture, an attacker could reuse it to call the upstream API and access or consume the associated service.

Content

Scanner excerpt · generated/operations.json (reported line 15)May include surrounding context.

json

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · generated/operations.md (reported line 19)May include surrounding context.

md

| Name | In | Required | Type | Default | Description |
| --- | --- | --- | --- | --- | --- |
| `token` | `query` | yes | `string` | n/a | Access token for this API service. |
| `videoId` | `query` | yes | `string` | n/a | The unique video identifier (aweme_id or model_id). |

### Request body

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill defines the API token as a query parameter and automatically appends it to the request URL. Query-string credentials are commonly exposed in logs, browser/history equivalents, proxy caches, monitoring tools, and error reports, making accidental credential disclosure more likely even when HTTPS is used.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This JSON describes the skill's purpose and operation but does not provide any explicit activation phrases, constraints, or negative examples clarifying when the skill should be invoked versus not invoked. For manifest files, that lack of trigger specificity can lead to overly broad matching by downstream systems.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.