Security audit

Douyin Creator Marketplace (Xingtu) Author Commerce Spread Info API

Security checks for vulnerabilities and agentic risk

Overview

This is a narrow JustOneAPI endpoint wrapper, but it should go to Review because it passes the user's API token through command-line arguments and the request URL.

Install only if you trust JustOneAPI and understand that the oAuthorId and your API token are sent to api.justoneapi.com. Use a scoped or short-lived token if possible, avoid running this under shell tracing or CI logs, and rotate the token if it may have appeared in process telemetry or URL logs.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: bin/run.mjs:175
Finding: API Token Exposed Through Command-Line Arguments and URL Query Parameters
Content: View full analysis
"}' ``` `SKILL.md:45` ```markdown - Pass the token with `--token "$JUST_ONE_API_TOKEN"`; do not paste token values into chat messages, screenshots, or logs. ``` `bin/run.mjs:22-30` ```javascript { "defaultValue": null, "description": "User authentication token.", "enumValues": [], "location": "query", "name": "token", "required": true, "schemaType": "string" } ``` `bin/run.mjs:69-76` ```javascript const params = parseParams(args.paramsJson); applyDefaults(operation, params); injectToken(operation, params, args.token); validateRequired(operation, params); const baseUrl = manifest.baseUrl; const url = new URL(operation.path, ensureBaseUrl(baseUrl)); applyPathParams(operation, params, url); applyQueryParams(operation, params, url); ``` `bin/run.mjs:91` ```javascript response = await fetch(url, requestInit); ``` `bin/run.mjs:175-188` ```javascript function injectToken(operation, params, cliToken) { const tokenParam = operation.parameters.find((parameter) => parameter.name === "token"); if (!tokenParam || params.token !== undefined) { return; } if (!cliToken) { fail("--token is required for this operation.", { operationId: operation.operationId, }); } params.token = cliToken; } ``` `bin/run.mjs:224-233` ```javascript function appendValue(searchParams, name, value) { if (Array.isArray(value)) { for (const item of value) { appendValue(searchParams, name, item); } return; } if (value && typeof value === "object") { searchParams.append(name, JSON.stringify(value)); return; } searchParams.appe ...[truncated 2685 chars]
Remediation: View remediation
"}' ``` 5. If the upstream API strictly requires query-based authentication, document that residual risk, prevent the helper from logging complete URLs, configure proxies and monitoring systems to redact the `token` parameter, disable shell tracing around invocation, and use short-lived, least-privileged tokens. 6. Rotate any token suspected of having appeared in process telemetry, command histories, CI logs, proxy logs, or server access logs. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill invokes a Node helper that performs outbound API requests using a token, but the manifest does not declare an explicit tool scope such as allowed network access. This creates a permission-transparency gap: a user or host may not be clearly informed that executing the skill can make external network calls and transmit user-supplied identifiers to a third-party service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill defines the authentication token as a query parameter and then appends all query parameters directly into the request URL. Query-string tokens are commonly exposed through logs, browser history, proxy caches, monitoring systems, error messages, and referrer propagation, making accidental credential disclosure materially more likely than if the token were sent in an Authorization header. In this skill context, the risk is real because the script is a generic API wrapper and provides no warning to users that their token will be placed in the URL.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.