Douyin (TikTok China) Comment Replies API

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:06 AM UTC
• Version: 1.0.0

Overview

The skill does the advertised JustOneAPI comment-replies lookup, but it passes the API token through command-line arguments and URL query parameters where it can be accidentally exposed.

Review this before installing if your JustOneAPI token has broad permissions, billing impact, or long lifetime. Use a narrowly scoped, revocable token where possible, avoid sharing command logs or process telemetry, and rotate the token if it may have appeared in logs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: bin/run.mjs:17

Finding

API Credential Exposed Through Process Arguments and URL Query Parameters

Content

View full analysis

parameter.name === "token"); if (!tokenParam || params.token !== undefined) { return; } if (!cliToken) { fail("--token is required for this operation.", { operationId: operation.operationId, }); } params.token = cliToken; } ``` ```js function applyQueryParams(operation, params, url) { for (const parameter of operation.parameters.filter((item) => item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } ``` The documented invocation also places the credential in a command-line argument: ...[truncated 2616 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The presence of an 'Access token' parameter indicates the skill handles credentials, and in this case the token is explicitly required in a query parameter. While using an API token is expected for third-party services, exposing it through the request URL materially increases the risk of credential leakage through logs, telemetry, referrers, and shared debugging output.

Content

Scanner excerpt · generated/operations.json (reported line 15)May include surrounding context.

json

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bin/run.mjs (reported line 20)May include surrounding context.

js

| Name | In | Required | Type | Default | Description |
| --- | --- | --- | --- | --- | --- |
| `token` | `query` | yes | `string` | n/a | Access token for this API service. |
| `commentId` | `query` | yes | `string` | n/a | The unique identifier of the top-level comment. |
| `page` | `query` | no | `integer` | `1` | Page number (starting from 1). |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · generated/operations.md (reported line 19)May include surrounding context.

md

| Name | In | Required | Type | Default | Description |
| --- | --- | --- | --- | --- | --- |
| `token` | `query` | yes | `string` | n/a | Access token for this API service. |
| `commentId` | `query` | yes | `string` | n/a | The unique identifier of the top-level comment. |
| `page` | `query` | no | `integer` | `1` | Page number (starting from 1). |

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill invokes a network-capable helper (node .../bin/run.mjs) and requires an API token, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization gap where a host agent or reviewer cannot clearly constrain or audit outbound network use, increasing the chance of unintended external requests or over-broad execution in environments that rely on manifest-declared permissions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill sends the API access token in the URL query string, which is commonly logged by clients, proxies, gateways, observability tooling, browser history, and upstream servers. Even though the base URL uses HTTPS, query parameters are still widely exposed in logs and error traces, making accidental credential disclosure materially more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill requires an access token to be sent as a URL query parameter, which is less secure than using an Authorization header because query strings are commonly logged by servers, proxies, browser history, and monitoring systems. The manifest also provides no user-facing warning or disclosure about this credential handling, increasing the chance that users expose sensitive API tokens unintentionally.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.