Security audit

IMDb Streaming Picks API

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but it handles the required API token in ways that can expose it through process listings or URL logs.

Review this before installing if your JustOneAPI token has paid quota, broad account access, or sensitive usage implications. The endpoint scope is narrow and no malicious behavior was found, but tokens passed on the command line or in query strings may appear in local process metadata, shell traces, service logs, proxy logs, or API logs. Prefer a version that reads the token from a protected environment variable and sends it in an authorization header if the provider supports that.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: bin/run.mjs:187
Finding: API Token Exposed Through Process Arguments and URL Query Parameters
Content: View full analysis
parameter.name === "token"); if (!tokenParam || params.token !== undefined) { return; } if (!cliToken) { fail("--token is required for this operation.", { operationId: operation.operationId, }); } params.token = cliToken; } ``` Every parameter marked as a query parameter, including the token, is appended to the URL: ```js function applyQueryParams(operation, params, url) { for (const parameter of operation.parameters.filter((item) => item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } ``` The resulting URL is sent directly: ```js const baseUrl = manifest.baseUrl; const url = new URL(operation.path, ensureBaseUrl(baseUrl)); applyPathParams(operation, params, url); applyQueryParams(operation, params, url); ...[truncated 2895 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill requires the authentication token to be sent as a URL query parameter, which is commonly exposed through logs, browser/history layers, proxy infrastructure, monitoring tools, and error reporting systems. Although the request uses HTTPS, placing secrets in the URL materially increases accidental credential disclosure risk compared with using an Authorization header or other secret-bearing header.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The API requires an authentication token to be passed in the URL query string, which is a well-known unsafe pattern because query parameters are commonly recorded in browser history, reverse proxies, server access logs, analytics tooling, and monitoring systems. In this skill context, the token is a credential for a third-party API, so exposure could allow unauthorized reuse of the account or API quota by anyone who obtains the logged URL.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The manifest sets languageCountry to en_US by default, which imposes a specific language/locale choice when the user does not provide one. Although other locales are available, the file does not indicate user opt-in before applying the English (US) default.
Content: No source excerpt is available for this finding.