ClawHub
Back to skill

Security audit

Douyin (TikTok China) Video Search API

Security checks for vulnerabilities and agentic risk

Overview

This is a focused Douyin video-search API skill, but its token is sent to JustOneAPI as a URL query parameter, which users should treat carefully.

Install only if you are comfortable giving this skill a JustOneAPI token for Douyin video searches. Use a narrowly scoped or disposable token if available, avoid pasting the token into chat or logs, and rotate it if request URLs may have been captured by debugging or monitoring tools.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
bin/run.mjs:20
Finding

API Credential Exposed Through URL Query Parameters

Content
View full analysis

Vulnerability Details

File Location: bin/run.mjs:20-29, 132-139, 242-253, 276-284
Vulnerability Type: API credential disclosure through URL query-string authentication
Risk Level: Medium

Vulnerable Code

js
{
  "defaultValue": null,
  "description": "Access token for this API service.",
  "enumValues": [],
  "location": "query",
  "name": "token",
  "required": true,
  "schemaType": "string"
}
js
const params = parseParams(args.paramsJson);
applyDefaults(operation, params);
injectToken(operation, params, args.token);
validateRequired(operation, params);

const baseUrl = manifest.baseUrl;
const url = new URL(operation.path, ensureBaseUrl(baseUrl));
applyPathParams(operation, params, url);
applyQueryParams(operation, params, url);

const requestInit = {
  headers: {
    "accept": "application/json",
  },
  method: operation.method,
};

let response;
try {
  response = await fetch(url, requestInit);
} catch (error) {
  fail("Network request failed.", {
    cause: error instanceof Error ? error.message : String(error),
    operationId: operation.operationId,
  });
}
js
function injectToken(operation, params, cliToken) {
  const tokenParam = operation.parameters.find((parameter) => parameter.name === "token");
  if (!tokenParam || params.token !== undefined) {
    return;
  }
  if (!cliToken) {
    fail("--token is required for this operation.", {
      operationId: operation.operationId,
    });
  }
  params.token = cliToken;
}
js
function applyQueryParams(operation, params, url) {
  for (const parameter of operation.parameters.filter((item) => item.location === "query")) {
    const value = params[parameter.name];
    if (value === undefined) {
      continue;
    }
    appendValue(url.searchParams, parameter.name, value);
  }
}

Technical Analysis

The operation manifest defin ...[truncated 2763 chars]

Remediation
View remediation

Remediation Suggestions

  1. Prefer a provider-supported authentication header, such as:

    js
    const requestInit = {
  headers: {
    accept: "application/json",
    authorization: `Bearer ${args.token}`,
  },
  method: operation.method,
};

    Remove token from the query-parameter manifest and ensure it is never added to URLSearchParams.

  2. If JustOneAPI only supports query-string authentication:

    • Configure reverse proxies, gateways, application servers, and observability platforms to redact the token parameter.
    • Disable full request-URL logging where practical.
    • Ensure errors and debugging output never include url.href, request objects, or unredacted query strings.
    • Use narrowly scoped, short-lived tokens where the provider supports them.
    • Rotate tokens regularly and immediately after suspected exposure.
    • Monitor provider usage for anomalous requests or quota consumption.
    • Explicitly document the residual query-string exposure for users.

  3. Prevent callers from supplying token inside --params-json; accept it only through the dedicated credential channel. This reduces accidental inclusion in command examples and serialized parameter objects.

  4. Prefer reading the credential directly from JUST_ONE_API_TOKEN rather than requiring it as a command-line argument, because process arguments may be visible to local process-inspection tools on some operating systems.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Credential Access

High
Category
Privilege Escalation
Confidence
89% confidence
Finding

This finding is substantiated by the parameter definition describing an access token, and the surrounding context shows that the credential is expected from the user and transmitted on every request. In this skill context, that is more dangerous because the skill operationalizes credential handling for a third-party API and may cause users or hosting systems to disclose tokens through telemetry, debugging output, or shared request logs.

Content

Scanner excerpt · generated/operations.json (reported line 15)May include surrounding context.

json
"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bin/run.mjs (reported line 20)May include surrounding context.

js
| Name | In | Required | Type | Default | Description |
| --- | --- | --- | --- | --- | --- |
| `token` | `query` | yes | `string` | n/a | Access token for this API service. |
| `keyword` | `query` | yes | `string` | n/a | The search keyword. |
| `sortType` | `query` | no | `string` | `_0` | Sorting criteria for search results.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · generated/operations.md (reported line 19)May include surrounding context.

md
| Name | In | Required | Type | Default | Description |
| --- | --- | --- | --- | --- | --- |
| `token` | `query` | yes | `string` | n/a | Access token for this API service. |
| `keyword` | `query` | yes | `string` | n/a | The search keyword. |
| `sortType` | `query` | no | `string` | `_0` | Sorting criteria for search results.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill sends the API token as a URL query parameter, which is commonly logged by client tooling, proxies, gateways, browser/history mechanisms, and server access logs. Even though the request uses HTTPS, query-string credentials have broader exposure than headers and can be unintentionally disclosed during debugging, monitoring, or error handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill requires an API access token to be sent in the URL query string, which is commonly logged by clients, proxies, gateways, browser history, and monitoring systems. Even though this is only an interface definition, encoding credentials this way creates a real credential-exposure risk and normalizes an unsafe authentication pattern for downstream users.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.