ClawHub
Back to skill

Security audit

Douyin Creator Marketplace (Xingtu) Creator Profile API

Security checks for vulnerabilities and agentic risk

Overview

This is a focused API wrapper, but it handles the user's API token in ways that can expose it through process arguments and URL query logs.

Review this before installing if the JustOneAPI token has meaningful account access or paid quota. Use a narrowly scoped, revocable token, avoid logging commands or request URLs, and rotate the token if process metadata or URL logs may expose it.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
bin/run.mjs:221
Finding

API Token Exposed Through Command-Line Arguments and URL Query Parameters

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:44; bin/run.mjs:27, 221-228; related metadata in generated/operations.json:23-30 and generated/operations.md:20
Vulnerability Type: Credential exposure through process arguments and URL query strings
Risk Level: Medium

The documented invocation passes the API token as a command-line argument:

bash
node {baseDir}/bin/run.mjs --operation "gwApiAuthorGetAuthorBaseInfoV1" --token "$JUST_ONE_API_TOKEN" --params-json '{"oAuthorId":"<oAuthorId>"}'

The operation declares the token as a query parameter:

js
{
  "defaultValue": null,
  "description": "User authentication token.",
  "enumValues": [],
  "location": "query",
  "name": "token",
  "required": true,
  "schemaType": "string"
}

All parameters declared with the query location, including the token, are inserted into the request URL:

js
function applyQueryParams(operation, params, url) {
  for (const parameter of operation.parameters.filter((item) => item.location === "query")) {
    const value = params[parameter.name];
    if (value === undefined) {
      continue;
    }
    appendValue(url.searchParams, parameter.name, value);
  }
}

function appendValue(searchParams, name, value) {
  if (Array.isArray(value)) {
    for (const item of value) {
      appendValue(searchParams, name, item);
    }
    return;
  }
  if (value && typeof value === "object") {
    searchParams.append(name, JSON.stringify(value));
    return;
  }
  searchParams.append(name, String(value));
}

Technical Analysis

The token is exposed through two credential-handling mechanisms:

  1. The documented --token argument places the secret in the Node process command line. Depending on operating-system permissions and deployment configuration, command-line arguments may be visible through process inspection, diagnostic collection, shell histo ...[truncated 2275 chars]
Remediation
View remediation

Remediation Suggestions

  1. Read the token directly from process.env.JUST_ONE_API_TOKEN instead of requiring it through --token. Avoid placing credentials in command-line arguments.
  2. Prefer a standard authentication header, such as Authorization: Bearer ..., if JustOneAPI supports header-based authentication.
  3. If the upstream API exclusively requires query authentication:
    • Use a short-lived, narrowly scoped token.
    • Ensure application, proxy, gateway, and monitoring configurations redact the token query parameter.
    • Do not print or serialize the complete request URL.
    • Disable unnecessary HTTP diagnostics that may capture URLs.
    • Review redirect handling and reject unexpected redirects to prevent credentials from entering unintended request flows.
  4. Reject token inside --params-json so callers cannot bypass the intended credential source.
  5. Add automated tests verifying that tokens never appear in stdout, stderr, exception payloads, or diagnostic logs.
  6. Rotate the token immediately if existing process records or URL logs may have retained it.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding

The skill invokes a network-capable helper (node ... run.mjs) and is explicitly designed to call an external API, but it does not declare any tool scope such as allowed tools or permissions. This weakens enforcement boundaries and can allow the skill to be executed with broader-than-intended capabilities, especially in agent runtimes that rely on explicit scope declarations for policy control.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill defines the authentication token as a query parameter and automatically injects it into the URL. Query-string secrets are commonly exposed through logs, browser/history artifacts, monitoring systems, reverse proxies, and error messages, which increases the chance of credential leakage even when HTTPS is used. In this skill context, the risk is real because the code is a generic API wrapper and provides no warning to users that their token will be placed in the request URL.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The documentation explicitly requires a user authentication token in a query parameter but provides no warning about treating it as sensitive, avoiding logging, or preferring safer transport patterns. Query parameters are commonly exposed in logs, browser history, proxies, and monitoring systems, so omitting credential-handling guidance can lead to accidental token leakage by integrators.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The natural-language description and display name are hard-coded to a specific regional platform context, "Douyin Creator Marketplace (Xingtu)", without indicating that this is a region-specific skill or offering user choice. Under the policy, locale constraints should be clearly documented and justified when they are fixed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.