Security audit

Facebook Post Search API

Security checks for vulnerabilities and agentic risk

Overview

The skill does the advertised Facebook post search, but it handles the API token in ways that could expose it through command-line arguments and request URLs.

Review before installing if you will use a real JustOneAPI token. Prefer short-lived or narrowly scoped tokens, rotate the token after testing, avoid sensitive search keywords, and be aware that this implementation may expose the token in local process telemetry and JustOneAPI-side URL logs.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: bin/run.mjs:210
Finding: API Authentication Token Transmitted in the URL Query String
Content: View full analysis
item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } ``` The request is subsequently sent with the credential embedded in the URL: ```js try { response = await fetch(url, requestInit); } catch (error) { fail("Network request failed.", { cause: error instanceof Error ? error.message : String(error), operationId: operation.operationId, }); } ``` ### Technical Analysis The operation manifest classifies the required `token` parameter as a query parameter. `applyQueryParams()` processes every parameter with `location === "query"` and appends its value to `url.searchParams`. As a result, the final request has the following effective form: ```text https://api.justoneapi.com/api/facebook/search-post/v1?token=&keyword= ``` TLS protects the URL from passive observation while it is in transit. It does not prevent the complete URL from being retained by systems th ...[truncated 2076 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:42
Finding: API Authentication Token Exposed Through Process Command-Line Arguments
Content: View full analysis
"}' ``` The executable reads the secret directly from the process argument vector: ```js function parseArgs(argv) { const parsed = { operation: null, paramsJson: "{}", token: null }; for (let index = 0; index < argv.length; index += 1) { const flag = argv[index]; const value = argv[index + 1]; if (flag === "--operation") { parsed.operation = value; index += 1; continue; } if (flag === "--params-json") { parsed.paramsJson = value; index += 1; continue; } if (flag === "--token") { parsed.token = value; index += 1; continue; } fail(`Unknown argument "${flag}".`); } return parsed; } ``` The token is then copied into the request parameters: ```js function injectToken(operation, params, cliToken) { const tokenParam = operation.parameters.find((parameter) => parameter.name === "token"); if (!tokenParam || params.token !== undefined) { return; } if (!cliToken) { fail("--token is required for this operation.", { operationId: operation.operationId, }); } params.token = cliToken; } ``` ### Technical Analysis Although the Skill metadata declares `JUST_ONE_API_TOKEN` as a required environment variable, the instructions require shell expansion of that variable into `--token`. The expanded secret therefore becomes part of the Node process's argument vector. Depending on the operating system and runtime configuration, process arguments may be visible to local process-inspection utilities, process accou ...[truncated 1911 chars]
Remediation: View remediation
"}' ``` 4. If an explicit secret-input mechanism is required, use protected standard input, a permission-restricted file descriptor, or an operating-system secret manager rather than argv. 5. Ensure errors, debug output, telemetry, and crash reports never print the token. 6. Use narrowly scoped, short-lived tokens and support immediate revocation and rotation. 7. Avoid allowing `params-json` to override the token, so credentials have one controlled input path. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill invokes a network-capable helper (node .../bin/run.mjs) against an external API but does not declare an explicit tool scope such as permissions or allowed-tools. This creates an authorization and transparency gap: an agent runtime or reviewer cannot easily constrain or reason about the skill's outbound network behavior, increasing the risk of unintended data egress or over-broad tool access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill defines the API authentication token as a query parameter and later appends all query parameters directly to the request URL. Query-string credentials are routinely exposed in logs, browser history, proxy caches, monitoring systems, crash reports, and error telemetry, making accidental disclosure significantly more likely than if the token were sent in an Authorization header. In this skill context, the risk is real because the token is a required auth secret for a third-party API and the script provides no warning that it will be embedded in the URL.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest does not warn users that both the search keyword and an authentication token are sent to a third-party API endpoint. This creates a meaningful privacy and secret-handling risk because users may unknowingly submit sensitive search terms, and integrators may mishandle the token if the external transmission is not clearly disclosed.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The API requires a user security token to be sent as a query parameter, which is risky because query strings are commonly logged by servers, proxies, monitoring tools, browser history, and intermediary infrastructure. In an agent-skill context, this increases the chance of credential leakage through telemetry, debugging output, or accidental prompt/tool trace exposure.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The manifest description is too generic and does not clearly communicate when the skill will transmit user input to an external Facebook search endpoint. Underspecified trigger scope can cause users or calling agents to invoke the skill more broadly than intended, increasing the chance that sensitive or irrelevant queries are sent off-platform without informed expectation.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: This markdown names the operation and describes what it does, but it does not specify how or when the skill should be invoked, nor does it include any negative examples or scope constraints. For markdown files, that can create overly broad or unclear triggering behavior if an agent relies on the text for activation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.