Security audit

IMDb Chart Rankings API

Security checks for vulnerabilities and agentic risk

Overview

This is a focused IMDb rankings API skill, but its token handling can expose the user's API credential through process arguments and request URLs.

Review this before installing if you are sensitive to API-token exposure. Use a narrowly scoped JustOneAPI token, avoid shared machines or process telemetry that records command arguments, and rotate the token if full request URLs or command lines may have been logged.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:44
Finding: API token exposed through command-line arguments
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: bin/run.mjs:201
Finding: API token transmitted as a URL query parameter
Content: View full analysis
parameter.name === "token"); if (!tokenParam || params.token !== undefined) { return; } if (!cliToken) { fail("--token is required for this operation.", { operationId: operation.operationId, }); } params.token = cliToken; } ``` All query parameters, including `token`, are then appended to the URL: ```js function applyQueryParams(operation, params, url) { for (const parameter of operation.parameters.filter((item) => item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } function appendValue(searchParams, name, value) { if (Array.isArray(value)) { for (const item of value) { appendValue(searchParams, name, item); } return; } if (value && typeof value === "object") { searchParams.append(name, JSON.stringify(value)); return; } searchParams.append(name, String(value)); } ``` The completed URL is transmitted to the fixed JustOneAPI destination: ```js let response; try { response = await fetch(url, requestInit); } catch (error) { fail("Network request failed.", { cause: error instanceof Error ? error.message : String(error), operationId: operation.operationId, }); } ``` ...[truncated 2042 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill invokes a networked API and includes runnable helper instructions, but it does not declare any explicit tool scope such as allowed tools or permissions. That creates an authorization and review gap: a host agent may permit broader network behavior than intended, and users or orchestrators cannot clearly enforce least-privilege constraints for this skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill defines the authentication token as a query parameter and appends it to the request URL, which causes the secret to appear in places URLs are commonly logged or exposed, such as shell history, proxy logs, browser/debug tooling, observability systems, and upstream server access logs. Although the request is sent over HTTPS, query-string placement still increases credential disclosure risk compared with using an Authorization header.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The operation requires a user authentication token to be sent in the URL query string, which is an insecure pattern because query parameters are commonly captured in server logs, browser history, intermediary proxies, analytics systems, and error traces. Even when HTTPS is used, this design increases the chance of credential exposure and unauthorized reuse of the token beyond its intended scope.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This markdown file describes the skill's purpose and endpoint but does not specify how narrowly the skill should be invoked or provide exclusion conditions. Without explicit trigger scope or negative examples, an agent may over-apply the skill whenever IMDb rankings are mentioned.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.