Security audit

Douyin Creator Marketplace (Xingtu) Creator Link Structure API

Security checks for vulnerabilities and agentic risk

Overview

This is a focused JustOneAPI skill, but it handles the user's API token in a way that can expose it through command-line arguments and URL query logs.

Review this skill before installing if you use a sensitive or high-value JustOneAPI token. Its endpoint scope is narrow, but the token may appear in process metadata or server-side URL logs because the helper passes it on the command line and in the query string. Prefer a narrowly scoped, revocable token and rotate it if you suspect command or URL logging captured it.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: bin/run.mjs:17
Finding: API Authentication Token Exposed Through Command-Line Arguments and URL Query Parameters
Content: View full analysis
parameter.name === "token"); if (!tokenParam || params.token !== undefined) { return; } if (!cliToken) { fail("--token is required for this operation.", { operationId: operation.operationId, }); } params.token = cliToken; } ``` ```js function applyQueryParams(operation ...[truncated 3337 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill invokes a network-capable helper (node .../bin/run.mjs) that sends user-supplied parameters and an API token to an external service, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates a trust and containment gap: an agent or reviewer cannot easily determine from policy metadata that network access is intended, increasing the risk of unintended outbound requests or misuse of credentials.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill defines the authentication token as a query parameter and later appends all query parameters directly into the request URL. Query-string secrets are commonly exposed through logs, browser/history layers, monitoring systems, reverse proxies, and error messages, making accidental credential disclosure more likely than if the token were sent in an Authorization header. In this skill's context, the risk is elevated because the code is a generic API wrapper that may be run in automated environments where command lines and full URLs are routinely captured.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This JSON manifest describes the skill's function and display name but provides no explicit activation constraints, trigger phrases, or negative examples. For manifest files, that can make invocation conditions overly broad or ambiguous because nothing limits when the skill should be selected beyond a general description.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The manifest consistently targets 'Douyin Creator Marketplace (Xingtu)', a China-specific platform/domain, but does not state whether this locale/platform restriction is intentional or offer any user opt-in or alternative. Under the policy, hardcoded locale or language constraints can be a natural-language policy issue unless clearly documented and justified.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.