JD.com Product Comments API

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:54 AM UTC
• Version: 1.0.0

Overview

The skill is narrowly focused on fetching JD.com comments, but it should be reviewed because it handles the API token in ways that can expose it in command lines and URLs.

Install only if you are comfortable giving this skill a JustOneAPI token and making requests to api.justoneapi.com. Prefer a narrowly scoped, revocable token, avoid sharing logs or command histories from runs, and rotate the token if you suspect it was exposed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: bin/run.mjs:223

Finding

API Credential Exposed Through Process Arguments and URL Query Parameters

Content

View full analysis

"}' ``` `bin/run.mjs:30-37`: ```javascript { "defaultValue": null, "description": "Access token for this API service.", "enumValues": [], "location": "query", "name": "token", "required": true, "schemaType": "string" } ``` `bin/run.mjs:77-81`: ```javascript const params = parseParams(args.paramsJson); applyDefaults(operation, params); injectToken(operation, params, args.token); validateRequired(operation, params); ``` `bin/run.mjs:94`: ```javascript response = await fetch(url, requestInit); ``` `bin/run.mjs:182-195`: ```javascript function injectToken(operation, params, cliToken) { const tokenParam = operation.parameters.find((parameter) => parameter.name === "token"); if (!tokenParam || params.token !== undefined) { return; } if (!cliToken) { fail("--token is required for this operation.", { operationId: operation.operationId, }); } params.token = cliToken; } ``` `bin/run.mjs:223-230`: ```javascript function applyQueryParams(operation, params, url) { for (const parameter of operation.parameters.filter((item) => item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } ``` ### Technical Analysis The access token is first passed through the `--token` command-line argument. Depending on the operating system and execution environment, command-line arguments may be visible through process-inspection interfaces, shell ...[truncated 2109 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 82% confidence

Finding

This finding is supported by the parameter description and surrounding schema: the operation explicitly requests an access token from the caller. In this interface context, credential use itself is expected, but the dangerous part is that the credential is collected via a query parameter, which increases exposure and could facilitate credential leakage to logs or third parties.

Content

Scanner excerpt · generated/operations.json (reported line 15)May include surrounding context.

json

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bin/run.mjs (reported line 20)May include surrounding context.

js

| Name | In | Required | Type | Default | Description |
| --- | --- | --- | --- | --- | --- |
| `token` | `query` | yes | `string` | n/a | Access token for this API service. |
| `itemId` | `query` | yes | `string` | n/a | A unique product identifier on JD.com (item ID). |
| `page` | `query` | no | `string` | n/a | Page number for paginated comments. |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · generated/operations.md (reported line 19)May include surrounding context.

md

| Name | In | Required | Type | Default | Description |
| --- | --- | --- | --- | --- | --- |
| `token` | `query` | yes | `string` | n/a | Access token for this API service. |
| `itemId` | `query` | yes | `string` | n/a | A unique product identifier on JD.com (item ID). |
| `page` | `query` | no | `string` | n/a | Page number for paginated comments. |

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill invokes a network-capable helper (node {baseDir}/bin/run.mjs) and uses an external API token, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates an authorization gap where an agent platform may permit broader networked behavior than reviewers or policy controls expect, reducing transparency and weakening sandbox enforcement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill sends the API access token as a URL query parameter, which is routinely exposed in logs, browser histories, proxy records, monitoring systems, and error traces. Even though the request uses HTTPS, query-string secrets are more widely propagated than headers and can be unintentionally disclosed to operators or adjacent systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill requires an API access token in the URL query string, which is commonly captured in browser history, proxy logs, server access logs, analytics tools, and error traces. Even if transport uses HTTPS, placing credentials in the URL materially increases accidental credential disclosure risk across intermediaries and operational tooling.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.