Douyin Creator Marketplace (Xingtu) Conversion Analysis API

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:12 AM UTC
• Version: 1.0.0

Overview

The skill does what it claims, but it sends the JustOneAPI credential as a URL query parameter, which creates a real token-exposure risk users should review before installing.

Install only if you are comfortable with your JustOneAPI token being sent in the request URL to the provider endpoint. Use a narrowly scoped or disposable token if available, avoid logging full request URLs, and rotate the token if you suspect it has appeared in logs or telemetry.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: bin/run.mjs:27

Finding

Authentication Token Exposed in URL Query String

Content

View full analysis

Vulnerability Details

File Location: bin/run.mjs:27-35, bin/run.mjs:98-100, and bin/run.mjs:217-226
Vulnerability Type: Authentication credential exposure through URL query parameters
Risk Level: Medium

Vulnerable Code

The operation manifest defines the authentication token as a query parameter:

js

{
  "defaultValue": null,
  "description": "User authentication token.",
  "enumValues": [],
  "location": "query",
  "name": "token",
  "required": true,
  "schemaType": "string"
},

The token is injected into the request parameters and all query parameters are added to the URL:

js

const params = parseParams(args.paramsJson);
applyDefaults(operation, params);
injectToken(operation, params, args.token);
validateRequired(operation, params);

const baseUrl = manifest.baseUrl;
const url = new URL(operation.path, ensureBaseUrl(baseUrl));
applyPathParams(operation, params, url);
applyQueryParams(operation, params, url);

The query parameter implementation serializes the token directly into url.searchParams:

js

function applyQueryParams(operation, params, url) {
  for (const parameter of operation.parameters.filter((item) => item.location === "query")) {
    const value = params[parameter.name];
    if (value === undefined) {
      continue;
    }
    appendValue(url.searchParams, parameter.name, value);
  }
}

js

function appendValue(searchParams, name, value) {
  if (Array.isArray(value)) {
    for (const item of value) {
      appendValue(searchParams, name, item);
    }
    return;
  }
  if (value && typeof value === "object") {
    searchParams.append(name, JSON.stringify(value));
    return;
  }
  searchParams.append(name, String(value));
}

Technical Analysis

The helper sends the API token in a request URL resembling:

text

https://api.justoneapi.com/api/douyin-xingtu/get-kol-convert-ability/v1?token=SECRET&kolId=...&range=_1

TLS protects the URL while it travels between the client and ...[truncated 3044 chars]

Remediation

View remediation

Remediation Suggestions

1. Use an authorization header

   If supported by the upstream service, remove token from the operation's query parameters and transmit it in a header:

   js

   const requestInit = {
     headers: {
       accept: "application/json",
       authorization: `Bearer ${args.token}`,
     },
     method: operation.method,
   };
   

2. Prefer environment-based credential loading

   Read JUST_ONE_API_TOKEN directly from the environment instead of requiring the token as a command-line argument:

   js

   const token = process.env.JUST_ONE_API_TOKEN;
   

   Avoid printing the token or including it in exception details.

3. If query authentication is unavoidable

   If JustOneAPI only accepts query-based authentication:

   • Document the resulting logging and telemetry risks explicitly.
   • Use narrowly scoped, short-lived tokens where the provider supports them.
   • Configure servers, gateways, proxies, and monitoring systems to redact the token parameter.
   • Ensure request URLs are never included in application errors or debug logs.
   • Prevent URL-query data from being stored in analytics systems.
   • Rotate tokens that may already have been retained in logs.

4. Update generated metadata and documentation

   Change generated/operations.json, generated/operations.md, and the embedded manifest consistently so future regeneration does not restore query-string authentication.

5. Add regression tests

   Add a test that constructs a request and verifies that the resulting URL does not contain token, while confirming that the authentication header is present and is redacted from diagnostic output.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill invokes a network-capable helper (node {baseDir}/bin/run.mjs) and is explicitly designed to call a remote API, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates a governance gap: an agent platform may permit broader tool or network access than intended, making review, sandboxing, and least-privilege enforcement weaker.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill defines the authentication token as a query parameter and automatically injects it into the request URL. Query-string tokens are commonly exposed through logs, proxies, browser/history tooling, monitoring systems, and error messages, which increases the chance of credential leakage even when HTTPS is used. In this skill’s context, the risk is real because the token is a required auth credential for a third-party API and the code provides no warning or safer alternative.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The API requires a user authentication token to be sent in the URL query string, which is a well-known insecure pattern because query parameters are commonly logged by servers, proxies, analytics tools, browser history, and observability systems. Even though the base URL uses HTTPS, the token can still be exposed through application logs and intermediary infrastructure, leading to credential leakage and unauthorized API access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The operation documents an authentication token as a query parameter without any warning or safer handling guidance. Query parameters are commonly exposed in browser history, intermediary logs, analytics systems, and monitoring tools, so documenting token use this way increases the chance of credential leakage even if the endpoint itself is legitimate.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.