ClawHub
Back to skill

Security audit

Douyin Creator Marketplace (Xingtu) Conversion Analysis API

Security checks for vulnerabilities and agentic risk

Overview

The skill is narrowly scoped to one JustOneAPI lookup, but it handles the API token in ways that can expose it in URLs and process arguments.

Review this skill before installing if your JustOneAPI token has meaningful quota, billing, or data access. Use a narrowly scoped token if available, avoid running it on shared or heavily monitored systems, avoid logging full request URLs or process arguments, and rotate the token if it may have appeared in logs.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
bin/run.mjs:245
Finding

API Credential Exposed in the Request URL Query String

Content
View full analysis

Vulnerability Details

File Location: bin/run.mjs:17-25, bin/run.mjs:202-213, bin/run.mjs:245-267, and bin/run.mjs:115
Vulnerability Type: API credential disclosure through URL query parameters
Risk Level: Medium

Vulnerable Code

js
{
  "defaultValue": null,
  "description": "User authentication token.",
  "enumValues": [],
  "location": "query",
  "name": "token",
  "required": true,
  "schemaType": "string"
}
js
function injectToken(operation, params, cliToken) {
  const tokenParam = operation.parameters.find((parameter) => parameter.name === "token");
  if (!tokenParam || params.token !== undefined) {
    return;
  }
  if (!cliToken) {
    fail("--token is required for this operation.", {
      operationId: operation.operationId,
    });
  }
  params.token = cliToken;
}
js
function applyQueryParams(operation, params, url) {
  for (const parameter of operation.parameters.filter((item) => item.location === "query")) {
    const value = params[parameter.name];
    if (value === undefined) {
      continue;
    }
    appendValue(url.searchParams, parameter.name, value);
  }
}

function appendValue(searchParams, name, value) {
  if (Array.isArray(value)) {
    for (const item of value) {
      appendValue(searchParams, name, item);
    }
    return;
  }
  if (value && typeof value === "object") {
    searchParams.append(name, JSON.stringify(value));
    return;
  }
  searchParams.append(name, String(value));
}
js
response = await fetch(url, requestInit);

Technical Analysis

The authentication token is inserted into the general parameter object, classified as a query parameter, appended to the URL, and transmitted to the fixed JustOneAPI endpoint. TLS protects the URL while it is in transit, but it does not prevent the complete URL from being recorded by the API server, reverse pro ...[truncated 1395 chars]

Remediation
View remediation

Remediation Suggestions

  1. Use an authentication header, such as Authorization: Bearer <token>, if JustOneAPI supports it.
  2. Keep the token separate from ordinary endpoint parameters so it cannot be serialized accidentally.
  3. Add explicit URL-redaction logic before URLs are written to logs, errors, or telemetry.
  4. Configure API gateways, proxies, and backend services not to record sensitive query parameters.
  5. Use short-lived, narrowly scoped tokens and provide straightforward rotation and revocation controls.
  6. If query-string authentication is an unavoidable upstream requirement, document this residual risk prominently and verify that every network layer suppresses or redacts the token parameter.

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:45
Finding

API Credential Exposed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:45-53 and bin/run.mjs:156-176
Vulnerability Type: Sensitive credential passed through process arguments
Risk Level: Low

Vulnerable Code

bash
node {baseDir}/bin/run.mjs --operation "gwApiDataSpGetAuthorConvertAbilityV1" --token "$JUST_ONE_API_TOKEN" --params-json '{"oAuthorId":"<oAuthorId>"}'
js
function parseArgs(argv) {
  const parsed = { operation: null, paramsJson: "{}", token: null };
  for (let index = 0; index < argv.length; index += 1) {
    const flag = argv[index];
    const value = argv[index + 1];
    if (flag === "--operation") {
      parsed.operation = value;
      index += 1;
      continue;
    }
    if (flag === "--params-json") {
      parsed.paramsJson = value;
      index += 1;
      continue;
    }
    if (flag === "--token") {
      parsed.token = value;
      index += 1;
      continue;
    }
    fail(`Unknown argument "${flag}".`);
  }
  return parsed;
}

Technical Analysis

The documented invocation expands JUST_ONE_API_TOKEN into the process argument vector. Depending on operating-system permissions and runtime configuration, command-line arguments may be visible through process-inspection interfaces, execution auditing, monitoring agents, diagnostic tools, or crash reports.

The documentation warns users not to paste token values into logs, but that warning does not prevent process-level exposure caused by the prescribed invocation. The Skill already declares JUST_ONE_API_TOKEN as a required environment variable, so requiring the same secret through --token is unnecessary.

Attack Path

  1. A user launches the documented command with JUST_ONE_API_TOKEN set.
  2. The shell expands the variable and places the token in the Node.js process argument vector.
  3. A local user, monitoring agent, or auditing component with sufficient process visibility captures ...[truncated 680 chars]
Remediation
View remediation

Remediation Suggestions

  1. Read the token directly from process.env.JUST_ONE_API_TOKEN.
  2. Remove --token from the documented command and preferably from the command-line interface entirely.
  3. If an override is necessary, accept it through standard input or a protected credential file rather than an argument.
  4. Never include the token in diagnostic output, error details, telemetry, or crash reports.
  5. Document token rotation and revocation procedures.
  6. Restrict tokens to the minimum API scope and use short expiration periods where supported.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill invokes a network-capable helper (node {baseDir}/bin/run.mjs) and is explicitly designed to call an external API, but it does not declare any tool scope such as permissions or allowed-tools. This creates an authorization/governance gap: an agent runtime may permit broader tool use than intended, making external requests without explicit, reviewable restriction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill sends the authentication token as a query parameter, which places the secret in the full request URL. URLs are commonly logged by clients, proxies, gateways, browser history, monitoring systems, and error reports, so the token can be exposed even when HTTPS is used for transport.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The API requires a sensitive authentication token to be sent in the URL query string, which is commonly captured in server logs, browser history, proxy logs, analytics systems, and error reports. Even when HTTPS is used, query-parameter credentials are more broadly exposed than header-based secrets, and the manifest provides no warning or mitigation to users of the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The API documentation instructs callers to send the authentication token in the URL query string, which is commonly exposed through browser history, reverse-proxy logs, monitoring systems, analytics tools, and referrer leakage. Even in a generated OpenAPI-derived skill, documenting token transmission this way encourages insecure client implementations and increases the chance of credential disclosure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.