Douyin Creator Marketplace (Xingtu) Conversion Resources API

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:19 AM UTC
• Version: 1.0.0

Overview

The skill is a focused JustOneAPI/Douyin API wrapper, but it handles the required API token in a way that can expose credentials through process arguments and URL query logs.

Install only if you are comfortable giving this skill a JustOneAPI token for the Douyin/Xingtu endpoint. Use a narrowly scoped or short-lived token if available, avoid sharing logs or command traces, and rotate the token if it may have appeared in process listings, URLs, screenshots, proxy logs, or diagnostics.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: bin/run.mjs:220

Finding

API Token Exposed Through Process Arguments and URL Query Parameters

Content

View full analysis

Vulnerability Details

File Location: bin/run.mjs:20-29, 95-102, 220-230; supporting invocation guidance at SKILL.md:45-51
Vulnerability Type: Credential exposure through command-line arguments and URL query parameters
Risk Level: Medium

The Skill legitimately needs an authentication token to call the declared JustOneAPI endpoint. However, the token is accepted as a command-line argument and subsequently transmitted as a URL query parameter.

Relevant parameter declaration:

js

{
  "defaultValue": null,
  "description": "User authentication token.",
  "enumValues": [],
  "location": "query",
  "name": "token",
  "required": true,
  "schemaType": "string"
},

Request construction and transmission:

js

const baseUrl = manifest.baseUrl;
const url = new URL(operation.path, ensureBaseUrl(baseUrl));
applyPathParams(operation, params, url);
applyQueryParams(operation, params, url);

const requestInit = {
  headers: {
    "accept": "application/json",
  },
  method: operation.method,
};

Token injection:

js

function injectToken(operation, params, cliToken) {
  const tokenParam = operation.parameters.find((parameter) => parameter.name === "token");
  if (!tokenParam || params.token !== undefined) {
    return;
  }
  if (!cliToken) {
    fail("--token is required for this operation.", {
      operationId: operation.operationId,
    });
  }
  params.token = cliToken;
}

The documented invocation also places the secret in the process argument list:

bash

node {baseDir}/bin/run.mjs --operation "getKolConvertVideosOrProductsV1" --token "$JUST_ONE_API_TOKEN" --params-json '{"kolId":"<kolId>","detailType":"_1","page":1}'

Technical Analysis

Process command-line arguments can be exposed through local process inspection, execution telemetry, shell tracing, job-runner metadata, diagnostic reports, or monitoring agents. Expan ...[truncated 2024 chars]

Remediation

View remediation

Remediation Suggestions

1. Read the token directly from process.env.JUST_ONE_API_TOKEN rather than requiring it through --token. If a CLI override must remain available, clearly mark it as unsafe and avoid using it in the default documentation.
2. If supported by JustOneAPI, transmit the credential in an authorization header, such as Authorization: Bearer ..., rather than in the URL query string.
3. If the provider requires query-based authentication, request or adopt a header-authenticated API version. Until then, ensure that reverse proxies, gateways, observability systems, and error handlers redact the token query parameter.
4. Never print or include the constructed authenticated URL in normal output or error details. Add automated tests that verify token values do not appear in stdout, stderr, or diagnostic messages.
5. Use short-lived, narrowly scoped tokens where the provider supports them, enforce usage limits, monitor abnormal API activity, and provide a documented revocation and rotation procedure.
6. Update SKILL.md to recommend direct environment-variable consumption and explicitly warn against placing secret values in command lines, shell history, screenshots, or logs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill invokes a network-capable helper (node {baseDir}/bin/run.mjs) that sends user-supplied parameters and an API token to an external service, but the manifest does not declare an explicit tool scope such as permissions or allowed-tools. This weakens defense-in-depth by preventing policy engines and reviewers from clearly constraining or approving the skill's external communication behavior, increasing the risk of unintended data egress or overly broad runtime capabilities.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill defines the authentication token as a query parameter and injects it into the request URL, which means the secret can be exposed through logs, browser/history mechanisms, proxy logs, analytics, referrer leakage, and operational telemetry. Even though the request is sent over HTTPS, putting credentials in the URL materially increases the chance of accidental disclosure compared with using an Authorization header or request body.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This JSON manifest describes the API operation and display name but does not define specific activation phrases, boundaries, or exclusion conditions. For manifest files, missing trigger specificity can cause unintended invocation because there is no clear statement of when the skill should or should not be used.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The manifest is tied to a Chinese platform context, but there is no natural-language indication that users can opt into this locale/domain or that the regional constraint is intentional and documented. This can be a policy concern if the skill forces a specific locale context without user choice or justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation explicitly requires a user authentication token in a query parameter but does not warn about secure handling, logging, URL leakage, or privacy implications. Query tokens are commonly exposed through browser history, proxy logs, analytics, and referrer headers, so omitting guidance can lead to accidental credential disclosure by integrators.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.