Douyin Creator Marketplace (Xingtu) Cost Performance Analysis API

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:13 AM UTC
• Version: 1.0.0

Overview

The skill appears focused on the promised JustOneAPI Douyin lookup, but it passes the API token through command-line arguments and a URL query string, which can expose the credential in logs or process telemetry.

Review before installing if the JustOneAPI token has billing or broad account access. Prefer a narrowly scoped, revocable token, avoid running it on shared systems, and rotate the token if command histories, process telemetry, proxy logs, or service logs may capture full command lines or URLs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: bin/run.mjs:205

Finding

API Token Exposed Through Command-Line Arguments and URL Query Parameters

Content

View full analysis

Vulnerability Details

File Location: bin/run.mjs:80-87, bin/run.mjs:147-151, bin/run.mjs:205-213; documented usage at SKILL.md:38 and SKILL.md:45
Vulnerability Type: Credential exposure through process arguments and URL query strings
Risk Level: Medium

The Skill requires a JustOneAPI credential to perform its declared API request. Sending a credential to the fixed JustOneAPI service is necessary, but the selected transport mechanisms expose the token beyond the minimum necessary scope.

Relevant request-construction code:

js

const params = parseParams(args.paramsJson);
applyDefaults(operation, params);
injectToken(operation, params, args.token);
validateRequired(operation, params);

const baseUrl = manifest.baseUrl;
const url = new URL(operation.path, ensureBaseUrl(baseUrl));
applyPathParams(operation, params, url);
applyQueryParams(operation, params, url);

Relevant command-line parsing code:

js

function parseArgs(argv) {
  const parsed = { operation: null, paramsJson: "{}", token: null };
  for (let index = 0; index < argv.length; index += 1) {
    const flag = argv[index];
    const value = argv[index + 1];
    if (flag === "--operation") {
      parsed.operation = value;
      index += 1;
      continue;
    }
    if (flag === "--params-json") {
      parsed.paramsJson = value;
      index += 1;
      continue;
    }
    if (flag === "--token") {
      parsed.token = value;
      index += 1;
      continue;
    }
    fail(`Unknown argument "${flag}".`);
  }
  return parsed;
}

Relevant token injection code:

js

function injectToken(operation, params, cliToken) {
  const tokenParam = operation.parameters.find((parameter) => parameter.name === "token");
  if (!tokenParam || params.token !== undefined) {
    return;
  }
  if (!cliToken) {
    fail("--token is required for this operation.", {
      operationId: 
...[truncated 3596 chars]

Remediation

View remediation

Remediation Suggestions

1. Change the API authentication scheme to use an HTTP authorization header, such as:

   js

   const token = process.env.JUST_ONE_API_TOKEN;
   if (!token) {
     fail("JUST_ONE_API_TOKEN is required.");
   }
   
   const requestInit = {
     headers: {
       accept: "application/json",
       authorization: `Bearer ${token}`,
     },
     method: operation.method,
   };
   

   This requires corresponding support from the JustOneAPI backend. Do not silently switch authentication formats unless the service documents and validates the header.

2. Read the credential directly from process.env.JUST_ONE_API_TOKEN instead of accepting it through --token. Remove the token from process arguments and update SKILL.md accordingly.

3. Exclude authentication parameters from generic query-parameter construction. Treat credentials as a separate, explicitly handled security-sensitive field.

4. Configure clients, gateways, reverse proxies, application servers, and observability systems to redact authorization information and any legacy token query parameter.

5. If query-based authentication cannot immediately be removed, disable query-string logging wherever possible, use narrowly scoped and short-lived tokens, and rotate credentials that may already have appeared in process or URL logs.

6. Add automated tests verifying that credentials never appear in the constructed URL, standard output, standard error, or diagnostic messages.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill invokes a network-capable helper (node .../bin/run.mjs) and requires an API token, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates an authorization ambiguity where an agent platform may permit broader networked execution than reviewers or users expect, increasing the risk of unintended external requests and data egress.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill sends the authentication token as a URL query parameter (token), which is commonly exposed through logs, browser/history equivalents, reverse proxies, monitoring systems, and upstream service telemetry. Even though the request uses HTTPS, query parameters are still more broadly propagated and retained than headers, increasing the chance of credential leakage and reuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Passing an authentication token in a query parameter is risky because query strings are commonly logged by servers, proxies, gateways, browser history, and observability tooling, which can expose reusable credentials. In this skill, the parameter is explicitly named 'token' and required for the request, so the manifest normalizes an insecure credential-handling pattern without any user-facing warning or safer alternative.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This JSON manifest-like file describes the skill only in terms of a general analysis function, without any explicit invocation constraints, allowed trigger phrases, or exclusion examples. In a skill-routing system, broad descriptions like creator evaluation, campaign planning, and marketplace research can overlap with common analytical requests and increase unintended activation risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file describes an operation requiring a token parameter identified as a user authentication token, but it does not include any user-facing warning about supplying sensitive credentials. For markdown files, the skill description should warn when behavior could affect user privacy or involve sensitive data handling.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.