Security audit

Douyin Creator Marketplace (Xingtu) Conversion Resources API

Security checks for vulnerabilities and agentic risk

Overview

The skill is a focused JustOneAPI wrapper, but it handles the required API token in ways that can expose it through command arguments and URL logs.

Review before installing if your JustOneAPI token has broad scope or paid quota. Use a narrowly scoped or disposable token if possible, and assume the token could appear in local process telemetry or server-side URL logs because this skill sends it as a query parameter.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: bin/run.mjs:269
Finding: API Token Exposure Through Process Arguments and URL Query Parameters
Content: View full analysis
parameter.name === "token"); if (!tokenParam || params.token !== undefined) { return; } if (!cliToken) { fail("--token is required for this operation.", { operationId: operation.operationId, }); } params.token = cliToken; } ``` All query parameters, including the token, are appended to the request URL before the network request is made: ```js const baseUrl = manifest.baseUrl; const url = new URL(operation.path, ensureBaseUrl(baseUrl)); applyPathParams(operation, params, url); applyQueryParams(operation, params, url); const requestInit = { headers: { "accept": "application/json", }, method: operation.method, }; let response; try { response = await fetch(url, requestInit); } catch (error) { fail("Network request failed.", { cause: error instanceof Error ? error.message : String(error), operationId: operation.operationId, }); } ``` ```js function applyQueryParams(operation, params, url) { for (const parameter of operation.parameters.filter((item) => item.location === "query")) { const value = params[parameter.name]; ...[truncated 3629 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill documents execution of a Node helper that performs outbound API requests using a secret token, but it does not declare any explicit tool scope such as allowed tools or permissions. This creates a governance gap: an agent or reviewer cannot easily restrict or verify the skill's network capability, increasing the risk of unintended external calls or misuse of sensitive inputs and tokens.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill requires an authentication token and places it into the request URL as a query parameter, which is then sent to a third-party API endpoint. Query-string secrets are commonly exposed via logs, browser/history equivalents, proxy/CDN access logs, monitoring systems, crash reports, and error messages, making accidental credential disclosure more likely than if the token were sent in an Authorization header.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The file is entirely hard-coded for the Douyin/Xingtu platform, with user-facing descriptions and tags only in that specific regional platform context. There is no indication that the skill offers users a language/locale choice or documents the locale restriction as an explicit opt-in constraint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The operation requires a user authentication token and an author identifier, which means credentials and account-linked creator data are sent to an external API, but the skill text does not clearly disclose that data flow or its privacy implications. This can mislead users into providing sensitive tokens or third-party identifiers without informed consent, increasing the risk of accidental credential exposure or unintended data sharing.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.