Security audit

Douyin Creator Marketplace (Xingtu) Creator Order Experience API

Security checks for vulnerabilities and agentic risk

Overview

This is a focused API skill, but it handles the JustOneAPI token in ways that can expose credentials through command lines and request URLs.

Review before installing if your JustOneAPI token has broad account, billing, or data access. Use a narrowly scoped, revocable token if available, avoid sharing logs or command traces from runs, and treat returned creator commercial and transaction data as sensitive.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: bin/run.mjs:18
Finding: API Credential Exposed Through Command-Line Arguments and URL Query Parameters
Content: View full analysis
item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } ``` The documented invocation also passes the secret as a command-line argument: ```bash node {baseDir}/bin/run.mjs --operation "gwApiAggregatorGetAuthorOrderExperienceV1" --token "$JUST_ONE_API_TOKEN" --params-json '{"oAuthorId":""}' ``` ### Technical Analysis Authentication is necessary for the Skill's declared API functionality, and the credential is sent only to the declared HTTPS host, `api.justoneapi.com`. However, the implementation exposes the credential through two avoidable channels: 1. The `--token` argument places the expanded secret in the process command line. Depending on operating-system permissions and monitoring configuration, command lines may be visible through process inspection, audit systems, shell tracing, or process telemetry. 2. Because `token` is designated as a query parameter, `applyQueryParams` appends it to the URL. Query strings are commonly retained by reverse proxies, API gatew ...[truncated 2130 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill defines the authentication token as a query parameter and injects it into the request URL, which causes the secret to appear in URLs, logs, browser history, reverse proxies, monitoring systems, and error traces. Even though the request uses HTTPS, query-string tokens are routinely exposed to infrastructure and operational tooling, making accidental credential leakage more likely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill advertises access to commercial history and transaction-related creator data, which is privacy-sensitive and potentially business-sensitive, but it provides no warning, consent boundary, or usage restriction. In an agent setting, this increases the risk of silent retrieval or over-collection of third-party creator data without the user's understanding of the sensitivity involved.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation requires a user authentication token in a query parameter but provides no warning about treating it as sensitive or avoiding exposure in logs, browser history, proxies, and analytics systems. Passing credentials in URL query strings increases the chance of accidental disclosure, especially in generated API skills that may be used by automation agents without additional security context.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This manifest-style JSON describes what the skill does but provides no explicit activation constraints, exclusion conditions, or narrow trigger phrases. In manifest files, such lack of specificity can make invocation matching overly broad because the description is the main natural-language signal for when the skill should be used.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.