Douyin (TikTok China) User Search API

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:15 AM UTC
• Version: 1.0.0

Overview

The skill is a focused Douyin user-search API wrapper, but it passes the API token through command-line arguments and URL query parameters that can leak in process listings or logs.

Review this before installing if the JustOneAPI token has billing, quota, or broad account privileges. Use a limited, revocable token, avoid sensitive search terms, and assume the token may appear in local process metadata or URL-bearing logs unless the provider supports safer header-based authentication.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: bin/run.mjs:198

Finding

API Token Exposed Through Process Arguments and URL Query Parameters

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:44-52; bin/run.mjs:161-170, 198-209, 241-263; generated/operations.json:16-24; generated/operations.md:18
Vulnerability Type: Credential exposure through command-line arguments and URL query parameters
Risk Level: Medium

The documented invocation passes the API token as a command-line argument:

bash

node {baseDir}/bin/run.mjs --operation "searchDouyinUserV2" --token "$JUST_ONE_API_TOKEN" --params-json '{"keyword":"<keyword>"}'

The command-line parser stores the supplied token:

javascript

if (flag === "--token") {
  parsed.token = value;
  index += 1;
  continue;
}

The token is then inserted into the request parameters:

javascript

function injectToken(operation, params, cliToken) {
  const tokenParam = operation.parameters.find((parameter) => parameter.name === "token");
  if (!tokenParam || params.token !== undefined) {
    return;
  }
  if (!cliToken) {
    fail("--token is required for this operation.", {
      operationId: operation.operationId,
    });
  }
  params.token = cliToken;
}

Because the operation declares the token as a query parameter, the generic query builder appends it to the request URL:

javascript

function applyQueryParams(operation, params, url) {
  for (const parameter of operation.parameters.filter((item) => item.location === "query")) {
    const value = params[parameter.name];
    if (value === undefined) {
      continue;
    }
    appendValue(url.searchParams, parameter.name, value);
  }
}

function appendValue(searchParams, name, value) {
  if (Array.isArray(value)) {
    for (const item of value) {
      appendValue(searchParams, name, item);
    }
    return;
  }
  if (value && typeof value === "object") {
    searchParams.append(name, JSON.stringify(value));
    return;
  }
  searchParams.append(name, String
...[truncated 2823 chars]

Remediation

View remediation

Remediation Suggestions

1. Read the credential directly from process.env.JUST_ONE_API_TOKEN instead of accepting it through --token. This prevents routine exposure through process argument listings.

2. Remove or deprecate the --token option. If temporary compatibility is required, emit a security warning and prioritize the environment variable.

3. Use an Authorization header or another non-URL authentication header if JustOneAPI supports one. For example:

   javascript

   const token = process.env.JUST_ONE_API_TOKEN;
   if (!token) {
     fail("JUST_ONE_API_TOKEN is required.");
   }
   
   const requestInit = {
     headers: {
       accept: "application/json",
       authorization: `Bearer ${token}`,
     },
     method: operation.method,
   };
   

4. Remove token from the generic query-parameter manifest and ensure applyQueryParams can never serialize authentication credentials.

5. Reject token inside --params-json so callers cannot bypass centralized credential handling.

6. If the upstream service strictly requires query-string authentication, document that residual risk and ensure proxies, gateways, application logs, monitoring systems, and error reports redact the token parameter.

7. Avoid including complete request URLs in errors or diagnostics. Add automated tests that verify token values do not appear in standard output, standard error, process arguments under the recommended invocation, or application-generated logs.

8. Rotate any token suspected of having been captured in process-monitoring data or URL logs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The skill defines an access token as a query parameter and the runtime injects it directly into the request URL. Query-string secrets are commonly exposed through logs, proxies, browser/history equivalents, monitoring systems, and error reporting, making credential leakage much more likely than using an Authorization header.

Content

Scanner excerpt · bin/run.mjs (reported line 20)May include surrounding context.

js

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

This skill explicitly handles an access token as an input parameter and sends it to an external service, which is sensitive credential material. Because the token is defined as a query parameter, it is at elevated risk of leakage through logs, browser history, telemetry, reverse proxies, and monitoring systems, making credential compromise more likely than if it were confined to headers or a dedicated secret channel.

Content

Scanner excerpt · generated/operations.json (reported line 15)May include surrounding context.

json

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · generated/operations.md (reported line 19)May include surrounding context.

md

| Name | In | Required | Type | Default | Description |
| --- | --- | --- | --- | --- | --- |
| `token` | `query` | yes | `string` | n/a | Access token for this API service. |
| `keyword` | `query` | yes | `string` | n/a | The search keyword. |
| `page` | `query` | no | `integer` | `1` | Page number (starting from 1). |
| `userType` | `query` | no | `string` | n/a | Filter by user type.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill instructs the agent to invoke a network-capable helper (node .../run.mjs) against an external API, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates a policy gap where an orchestrator or reviewer cannot clearly constrain or audit the skill’s outbound network behavior, increasing the risk of unintended external requests or broader tool access than necessary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest requires sending both an access token and a user-provided search keyword to an external third-party API, but it provides no disclosure about credential handling, data sharing, retention, or privacy implications. This creates a real risk of unintended token exposure and user data transmission without informed consent, especially because the token is passed as a query parameter, which is commonly logged by clients, proxies, and servers.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The operation explicitly enables lookup of Douyin user profile metadata and follower-related signals, but the documentation omits any privacy, acceptable-use, or data-handling warning. In an agent skill context, this can normalize bulk profiling or account research without guardrails, increasing the chance of privacy misuse, stalking, or policy-noncompliant data collection.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

This JSON manifest describes the skill in broad terms but provides no explicit trigger phrases, activation boundaries, or negative examples clarifying when the skill should or should not be invoked. For manifest files, that lack of specificity can lead to unintended activation if orchestration relies on these descriptive fields.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This markdown describes an operation but provides no explicit trigger phrases, activation constraints, or exclusion conditions. In a skill context, the broad operation label 'User Search' and generic description could make it unclear when this skill should activate versus other search-related actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.