Douyin Creator Marketplace (Xingtu) Cost Performance Analysis API

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:15 AM UTC
• Version: 1.0.0

Overview

This is a focused JustOneAPI wrapper, but it passes the user's API token through command arguments and a URL query parameter, which creates a credential exposure risk.

Use this only with a scoped or short-lived JustOneAPI token and avoid running it where command lines or full request URLs may be logged. Rotate the token if it may have appeared in process listings, shell telemetry, proxy logs, or debugging output.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: bin/run.mjs:20

Finding

API Token Exposed Through Command-Line Arguments and URL Query Parameters

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:43-51; bin/run.mjs:20-25; bin/run.mjs:191-201; bin/run.mjs:230-237
Vulnerability Type: Sensitive credential exposure
Risk Level: Medium

Vulnerable Code

SKILL.md:43-51:

bash

node {baseDir}/bin/run.mjs --operation "gwApiDataSpAuthorCpInfoV1" --token "$JUST_ONE_API_TOKEN" --params-json '{"oAuthorId":"<oAuthorId>"}'

markdown

- Required: `JUST_ONE_API_TOKEN`
- Pass the token with `--token "$JUST_ONE_API_TOKEN"`; do not paste token values into chat messages, screenshots, or logs.

bin/run.mjs:20-25:

js

{
  "defaultValue": null,
  "description": "User authentication token.",
  "enumValues": [],
  "location": "query",
  "name": "token",
  "required": true,
  "schemaType": "string"
}

bin/run.mjs:191-201:

js

function injectToken(operation, params, cliToken) {
  const tokenParam = operation.parameters.find((parameter) => parameter.name === "token");
  if (!tokenParam || params.token !== undefined) {
    return;
  }
  if (!cliToken) {
    fail("--token is required for this operation.", {
      operationId: operation.operationId,
    });
  }
  params.token = cliToken;
}

bin/run.mjs:230-237:

js

if (value && typeof value === "object") {
  searchParams.append(name, JSON.stringify(value));
  return;
}
searchParams.append(name, String(value));

Technical Analysis

The Skill instructs users to supply the API token through the --token command-line argument. Command-line arguments can be exposed to other local users or administrative monitoring systems through process inspection, shell history, process accounting, audit systems, debugging output, or orchestration telemetry.

The manifest additionally classifies token as a query parameter. The token is injected into params, passed to applyQueryParams, and appended to the request URL usin ...[truncated 2602 chars]

Remediation

View remediation

Remediation Suggestions

1. Read the token directly from process.env.JUST_ONE_API_TOKEN instead of requiring it in --token. This prevents normal invocations from exposing the credential in process arguments and shell history.

2. If supported by JustOneAPI, send the credential in an authorization header rather than the query string:

   js

   const token = process.env.JUST_ONE_API_TOKEN;
   if (!token) {
     fail("JUST_ONE_API_TOKEN is required.");
   }
   
   const requestInit = {
     headers: {
       accept: "application/json",
       authorization: `Bearer ${token}`,
     },
     method: operation.method,
   };
   

3. Remove token from the operation's query-parameter definitions and prevent params-json from accepting a token field. Authentication material should be handled separately from ordinary endpoint parameters.

4. If the upstream API only accepts query authentication, coordinate an API change to support header-based credentials. Until then:

   • Read the token from the environment rather than command-line arguments.
   • Configure clients, proxies, gateways, and monitoring platforms to redact the token query parameter.
   • Avoid including complete URLs in errors or diagnostic output.
   • Use short-lived, narrowly scoped tokens with strict rate and quota limits.
   • Rotate the token immediately if process records or URL logs may have exposed it.

5. Add automated tests verifying that credentials never appear in command examples, standard output, standard error, exception payloads, or request logging.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill invokes a network-capable helper (node .../bin/run.mjs) and is designed to call an external API, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates an authorization gap where a host agent may permit broader tool use than intended, reducing isolation and auditability for outbound network access and token-backed API calls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill sends the authentication token as a query parameter, which places the secret directly into the URL. URLs are commonly logged by client tooling, proxies, gateways, browser/history layers, process monitors, and server access logs, so the token can be exposed outside the intended trust boundary even when HTTPS is used.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Passing an authentication token in the query string is dangerous because query parameters are commonly logged by servers, intermediaries, observability tooling, browser history, and error reports. Even though this skill targets a data API rather than a highly privileged admin action, token leakage could still allow unauthorized API access and exposure of creator marketplace analytics tied to the user's account.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

This is a JSON manifest file, so vague-trigger review applies. The top-level description only states what the API does and does not define explicit trigger phrases, scope limits, or exclusion conditions, which can make invocation criteria ambiguous in systems that infer activation from manifest text.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation instructs callers to supply a user authentication token but provides no guidance on secure handling, storage, transmission hygiene, or log redaction. In an API-integration skill, this omission can lead downstream users or agents to expose credentials in plaintext logs, examples, telemetry, or shared prompts, increasing the chance of token leakage and unauthorized API access.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.