ClawHub
Back to skill

Security audit

Douyin Creator Marketplace (Xingtu) Creator Link Metrics API

Security checks for vulnerabilities and agentic risk

Overview

This is a focused API wrapper, but it handles the JustOneAPI token in URL query parameters and command-line arguments, which can expose credentials in logs or process listings.

Review before installing if your JustOneAPI token has broad access, billing impact, or long lifetime. Use a narrowly scoped token if available, rotate it regularly, avoid shared machines or verbose process logging, and assume the token may be recorded by URL/query logging on the API path.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
bin/run.mjs:18
Finding

API Token Exposed Through Process Arguments and URL Query Parameters

Content
View full analysis

Vulnerability Details

File Location: bin/run.mjs:18-24, 202-205, 236-244, 278-284; documented usage in SKILL.md:45-53
Vulnerability Type: API credential exposure through command-line arguments and URL query strings
Risk Level: Medium

Vulnerable Code

bin/run.mjs:18-24 defines the authentication token as a query parameter:

js
      {
        "defaultValue": null,
        "description": "User authentication token.",
        "enumValues": [],
        "location": "query",
        "name": "token",
        "required": true,
        "schemaType": "string"
      },

bin/run.mjs:202-205 reads the secret from a command-line argument:

js
    if (flag === "--token") {
      parsed.token = value;
      index += 1;
      continue;
    }

bin/run.mjs:236-244 moves the command-line token into the request parameters:

js
function injectToken(operation, params, cliToken) {
  const tokenParam = operation.parameters.find((parameter) => parameter.name === "token");
  if (!tokenParam || params.token !== undefined) {
    return;
  }
  if (!cliToken) {
    fail("--token is required for this operation.", {
      operationId: operation.operationId,
    });
  }
  params.token = cliToken;
}

bin/run.mjs:278-284 appends every query parameter, including the token, to the request URL:

js
function applyQueryParams(operation, params, url) {
  for (const parameter of operation.parameters.filter((item) => item.location === "query")) {
    const value = params[parameter.name];
    if (value === undefined) {
      continue;
    }
    appendValue(url.searchParams, parameter.name, value);
  }
}

The documented invocation in SKILL.md:45 explicitly passes the secret through the process argument vector:

bash
node {baseDir}/bin/run.mjs --operation "gwApiDataSpGetAuthorLinkInfoV1" --token "$JUST_ONE_API_TOKEN" --params-json '{"oAu
...[truncated 2808 chars]
Remediation
View remediation

Remediation Suggestions

  1. Use an Authorization header rather than a query parameter if supported by JustOneAPI:

    js
    const requestInit = {
  method: operation.method,
  headers: {
    accept: "application/json",
    authorization: `Bearer ${token}`,
  },
};

    Keep the token out of params and explicitly prevent token from being appended to url.searchParams.

  2. Read the secret directly from process.env.JUST_ONE_API_TOKEN instead of requiring --token:

    js
    const token = process.env.JUST_ONE_API_TOKEN;
if (!token) {
  fail("JUST_ONE_API_TOKEN is required.");
}

    Environment variables can still be exposed in some privileged diagnostic contexts, but they avoid routine disclosure through command-line argument collection.

  3. If the upstream API strictly requires query-string authentication:

    • Avoid accepting the token in --params-json.
    • Read it from the environment at the last possible point.
    • Disable or redact query-string logging on clients, proxies, gateways, tracing platforms, and the destination service.
    • Ensure errors never include the complete request URL.
    • Document the residual exposure clearly.
    • Use narrowly scoped, short-lived credentials where available.
    • Establish token rotation and revocation procedures.

  4. Update SKILL.md, generated/operations.json, and generated/operations.md so that examples and generated metadata reflect the safer authentication mechanism.

  5. Add automated tests confirming that tokens never appear in process invocation examples, standard output, standard error, exception payloads, or request URLs.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill invokes a network-capable helper (node .../bin/run.mjs) that sends user-supplied query parameters to an external API, but it does not declare an explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and makes it easier for an agent runtime to grant broader capabilities than intended, reducing visibility and policy enforcement around outbound network use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill requires the authentication token as a query parameter and automatically injects it into the request URL. Query-string tokens are commonly exposed through logs, browser/history tooling, proxies, monitoring systems, and error telemetry, which increases the chance of credential disclosure even when HTTPS is used.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest describes required query parameters including a user authentication token and creator ID, but does not warn that these values are sent to an external service at api.justoneapi.com. This lack of disclosure can cause users or calling agents to expose sensitive credentials and target identifiers without informed consent, especially because the token is an authentication secret.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The operation documentation requires a token in the query string but does not warn that query parameters are commonly exposed in logs, browser history, proxies, analytics, and monitoring systems. Even though this is an API description rather than executable code, documenting credential transmission via URL normalizes an unsafe pattern that can lead to accidental token disclosure and reuse.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The operation description is broad and does not define when the skill should or should not be invoked, increasing the chance an agent may call an external API in situations the user did not clearly intend. In a skill that transmits authentication material and creator identifiers to a third-party endpoint, vague trigger scope can lead to unnecessary data disclosure or overbroad use.

Content

No source excerpt is available for this finding.