ClawHub
Back to skill

Security audit

Instagram Hashtag Posts Search API

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to call the advertised JustOneAPI Instagram hashtag endpoint, but it handles the API token in unnecessarily exposed ways and gives limited privacy guidance for social-media monitoring.

Review this before installing if you will use a valuable or broad JustOneAPI token. Prefer a narrowly scoped token, rotate it if exposed, avoid logging commands or request URLs, and use the endpoint only for compliant public-data scenarios consistent with Instagram, JustOneAPI, privacy, and local legal requirements.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
bin/run.mjs:30
Finding

API Token Exposed Through Process Arguments and URL Query Parameters

Content
View full analysis

Vulnerability Details

File Location: bin/run.mjs:30-37, 75-78, 192-202, 224-245; related usage and schema declarations in SKILL.md:44-49, generated/operations.json:14-22, and generated/operations.md:20
Vulnerability Type: Credential exposure through command-line arguments and URL query parameters
Risk Level: Medium

Vulnerable Code

bin/run.mjs:30-37 declares the access token as a query parameter:

js
{
  "defaultValue": null,
  "description": "Access token for the API service.",
  "enumValues": [],
  "location": "query",
  "name": "token",
  "required": true,
  "schemaType": "string"
}

bin/run.mjs:75-78 adds all query parameters, including the token, to the request URL:

js
const url = new URL(operation.path, ensureBaseUrl(baseUrl));
applyPathParams(operation, params, url);
applyQueryParams(operation, params, url);

bin/run.mjs:192-202 copies the command-line token into the request parameters:

js
function injectToken(operation, params, cliToken) {
  const tokenParam = operation.parameters.find((parameter) => parameter.name === "token");
  if (!tokenParam || params.token !== undefined) {
    return;
  }
  if (!cliToken) {
    fail("--token is required for this operation.", {
      operationId: operation.operationId,
    });
  }
  params.token = cliToken;
}

bin/run.mjs:224-245 serializes the token into the URL query string:

js
function applyQueryParams(operation, params, url) {
  for (const parameter of operation.parameters.filter((item) => item.location === "query")) {
    const value = params[parameter.name];
    if (value === undefined) {
      continue;
    }
    appendValue(url.searchParams, parameter.name, value);
  }
}

function appendValue(searchParams, name, value) {
  if (Array.isArray(value)) {
    for (const item of value) {
      appendValue(searchParams, name, item);
    }
    return;
  }
  if (value && typeof value === "object") {
    searchParams.append(name, JSON.stringify(va
...[truncated 3706 chars]
Remediation
View remediation

Remediation Suggestions

  1. Read the token directly from the environment

    • Replace the --token requirement with process.env.JUST_ONE_API_TOKEN.
    • Avoid expanding the credential into the command-line argument vector.
    • If a CLI override must remain available, clearly mark it as insecure and disable it by default.

  2. Move authentication out of the URL

    • Prefer an HTTP authorization header, for example:
js
const token = process.env.JUST_ONE_API_TOKEN;
if (!token) {
  fail("JUST_ONE_API_TOKEN is required.");
}

const requestInit = {
  headers: {
    accept: "application/json",
    authorization: `Bearer ${token}`,
  },
  method: operation.method,
};
  • Remove token from the query-parameter manifest and ensure it is never passed to URLSearchParams.
  • Confirm the exact authentication header format supported by JustOneAPI before deployment.

  1. If the upstream API only supports query authentication

    • Request header-based authentication support from the provider.
    • Use narrowly scoped and short-lived tokens where supported.
    • Configure clients, gateways, reverse proxies, access logs, application monitoring, and error telemetry to redact the token query parameter.
    • Never include the complete request URL in errors, debug output, analytics, or support bundles.

  2. Update documentation and generated artifacts

    • Change SKILL.md to invoke the helper without --token.
    • Update generated/operations.json and generated/operations.md so the token is not represented as a normal query input if header authentication is supported.
    • Document token rotation and immediate revocation procedures for suspected exposure.

  3. Add regression controls

    • Add tests asserting that generated request URLs never contain token.
    • Add secret-redaction tests for failure and diagnostic paths.
    • Use automated secret-handling or URL-policy checks to prevent credentials from being introduced into command argumen ...[truncated 26 chars]

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

The skill defines the API access token as a query parameter and injects it into the request URL, which causes the credential to be placed in the URL rather than a protected header. Query-string secrets are commonly exposed through logs, browser/history tooling, proxy telemetry, monitoring systems, and upstream service diagnostics, making credential disclosure significantly more likely.

Content

Scanner excerpt · bin/run.mjs (reported line 20)May include surrounding context.

js
"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for the API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

The API access token is passed as a query parameter, which is a risky credential-handling pattern because query strings are commonly logged by servers, proxies, browser histories, and monitoring tools. Exposure of the token could allow unauthorized use of the external API, billing abuse, or access to associated data and service capabilities.

Content

Scanner excerpt · generated/operations.json (reported line 15)May include surrounding context.

json
"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for the API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · generated/operations.md (reported line 19)May include surrounding context.

md
| Name | In | Required | Type | Default | Description |
| --- | --- | --- | --- | --- | --- |
| `token` | `query` | yes | `string` | n/a | Access token for the API service. |
| `hashtag` | `query` | yes | `string` | n/a | The hashtag or keyword to search for. |
| `endCursor` | `query` | no | `string` | n/a | Cursor used for retrieving the next page of results. |

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding

The skill invokes a network-capable helper (node .../bin/run.mjs) that sends user-supplied query parameters to an external API, but the manifest does not explicitly declare a tool scope such as permissions or allowed-tools. That mismatch weakens policy enforcement and user/operator visibility into what the skill is allowed to do, increasing the chance of unintended outbound requests or abuse if the skill is reused in a broader agent environment.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill description and operation metadata describe broad search and monitoring capabilities without clear activation boundaries, user-consent requirements, or use restrictions. In an agent setting, vague scope increases the chance the tool is invoked for sensitive surveillance, bulk monitoring, or ambiguous requests that exceed intended use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The description explicitly supports monitoring community discussions and public opinion, but it provides no jurisdictional, privacy, or platform-policy constraints. That omission can enable misuse for sentiment tracking, population monitoring, or compliance-violating collection in contexts where additional restrictions should apply.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The file states that the endpoint returns caption, author profile, publish time, and supports monitoring community discussions and public opinion, which implies collection and analysis of user-related social media data. The markdown does not include any warning or disclosure about privacy considerations, acceptable use, or handling of scraped/public profile data.

Content

No source excerpt is available for this finding.