Security audit

JD.com API

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to do the advertised JD.com API lookups, but it handles the required API token in ways that could expose it in process arguments or logged URLs.

Review this skill before installing if the JustOneAPI token has billing, quota, or sensitive-data access. Use a narrowly scoped token if available, avoid logging full commands or request URLs, and rotate the token if it may have appeared in process logs or URL logs.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: bin/run.mjs:318
Finding: API Token Exposed Through Process Arguments and URL Query Parameters
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:42; bin/run.mjs:22-28, 234-238, 268-276, 318-330
Vulnerability Type: Credential exposure through command-line arguments and URL query parameters
Risk Level: Medium

Vulnerable Code

SKILL.md:42 instructs users to pass the secret through a command-line argument:

bash
node {baseDir}/bin/run.mjs --operation "<operation-id>" --token "$JUST_ONE_API_TOKEN" --params-json '{"key":"value"}'

bin/run.mjs:22-28 defines the token as a query parameter:

js
{ "defaultValue": null, "description": "Access token for this API service.", "enumValues": [], "location": "query", "name": "token", "required": true, "schemaType": "string" }

bin/run.mjs:234-238 accepts the token from the process argument list:

js
if (flag === "--token") { parsed.token = value; index += 1; continue; }

bin/run.mjs:268-276 injects the supplied credential into the request parameters:

js
function injectToken(operation, params, cliToken) { const tokenParam = operation.parameters.find((parameter) => parameter.name === "token"); if (!tokenParam || params.token !== undefined) { return; } if (!cliToken) { fail("--token is required for this operation.", { operationId: operation.operationId, }); } params.token = cliToken; }

bin/run.mjs:318-330 serializes every query parameter, including the token, into the URL:

js
function applyQueryParams(operation, params, url) { for (const parameter of operation.parameters.filter((item) => item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } function appendValue(searchParams, name, value) { if (Array.isArray(value)) { for (const item of value) { a ...[truncated 3000 chars]
Remediation: View remediation
Remediation Suggestions

Read JUST_ONE_API_TOKEN directly from process.env rather than requiring a --token command-line argument:

js
const token = process.env.JUST_ONE_API_TOKEN; if (!token) { fail("JUST_ONE_API_TOKEN is required."); }

Remove support for credentials in both --token and --params-json so callers cannot inadvertently place secrets in process arguments.

If the service supports it, transmit the token in an authorization header rather than in the URL:

js
const requestInit = { method: operation.method, headers: { accept: "application/json", authorization: `Bearer ${token}`, }, };

If JustOneAPI currently requires query authentication, the service should add header-based authentication. Until that is available:

Avoid logging complete request URLs.

Redact token from proxy, gateway, server, and observability logs.

Never include the constructed URL in errors or diagnostics.

Use short-lived, narrowly scoped credentials where supported.

Update SKILL.md to invoke the helper without placing the token on the command line:

bash
JUST_ONE_API_TOKEN="$JUST_ONE_API_TOKEN" node {baseDir}/bin/run.mjs \ --operation "<operation-id>" \ --params-json '{"key":"value"}'

Rotate the credential if there is evidence that process arguments or full request URLs have already been retained in logs.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.
md
- Get a token from [Just One API Dashboard](https://dashboard.justoneapi.com/en/login?utm_source=clawhub.ai&utm_medium=referral&utm_campaign=justoneapi_jd&utm_content=project_link). - Authentication details: [Just One API Usage Guide](https://docs.justoneapi.com/en/?utm_source=clawhub.ai&utm_medium=referral&utm_campaign=justoneapi_jd&utm_content=project_link). ## Output Rules - Start with a plain-language answer tied to the JD.com task the user asked for. - Include the most decision-relevant fields from the selected endpoint before dumping raw JSON.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · bin/run.mjs (reported line 20)May include surrounding context.
js
"parameters": [ { "defaultValue": null, "description": "Access token for this API service.", "enumValues": [], "location": "query", "name": "token",

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · bin/run.mjs (reported line 66)May include surrounding context.
js
"parameters": [ { "defaultValue": null, "description": "Access token for this API service.", "enumValues": [], "location": "query", "name": "token",

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · bin/run.mjs (reported line 103)May include surrounding context.
js
"parameters": [ { "defaultValue": null, "description": "Access token for this API service.", "enumValues": [], "location": "query", "name": "token",

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · generated/operations.json (reported line 14)May include surrounding context.
json
"parameters": [ { "defaultValue": null, "description": "Access token for this API service.", "enumValues": [], "location": "query", "name": "token",

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · generated/operations.json (reported line 60)May include surrounding context.
json
"parameters": [ { "defaultValue": null, "description": "Access token for this API service.", "enumValues": [], "location": "query", "name": "token",

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · generated/operations.json (reported line 97)May include surrounding context.
json
"parameters": [ { "defaultValue": null, "description": "Access token for this API service.", "enumValues": [], "location": "query", "name": "token",

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · generated/operations.md (reported line 17)May include surrounding context.
md
"parameters": [ { "defaultValue": null, "description": "Access token for this API service.", "enumValues": [], "location": "query", "name": "token",

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · generated/operations.md (reported line 41)May include surrounding context.
md
"parameters": [ { "defaultValue": null, "description": "Access token for this API service.", "enumValues": [], "location": "query", "name": "token",

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · generated/operations.md (reported line 64)May include surrounding context.
md
"parameters": [ { "defaultValue": null, "description": "Access token for this API service.", "enumValues": [], "location": "query", "name": "token",

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill invokes a Node helper that performs authenticated external API requests, but the manifest does not declare an explicit tool scope such as permissions or allowed-tools. This creates a transparency and policy-enforcement gap: an agent/runtime may permit broader execution or network behavior than reviewers and users can easily see, increasing the chance of unintended data egress or misuse of the provided token.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The code appends all query parameters, including the required API token, into the URL via url.searchParams. Secrets in query strings are commonly exposed through logs, browser/history equivalents, reverse proxies, monitoring systems, and error reports, even when sent over HTTPS. In this skill context, the token is central to accessing a third-party API, so unnecessary URL exposure increases the chance of credential leakage.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This operation requires an API access token to be sent as a URL query parameter. Query strings are commonly logged by clients, proxies, gateways, browser history, and observability tooling, so placing credentials there increases the chance of accidental disclosure even when HTTPS is used.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This operation also transmits the API token in the URL query string, which exposes sensitive credentials to logging and monitoring systems that capture full URLs. The lack of any user-facing warning or safer auth mechanism makes accidental token leakage more likely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The shop product list endpoint likewise sends the access token as a query parameter, repeating the same insecure credential transport pattern. Because this is a reusable API skill definition, the unsafe pattern may be propagated across integrations and operational logs.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation instructs users to pass an access token as a URL query parameter, which is commonly exposed through browser history, proxy logs, server access logs, analytics tools, and Referer headers. In a skill/API integration context, this increases the chance that secrets are unintentionally persisted or disclosed outside the intended trust boundary.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This endpoint repeats the same unsafe credential pattern by requiring the access token in the query string without any cautionary note. Repetition across multiple operations makes leakage more likely because downstream tooling and users will normalize insecure handling of the token.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Listing the access token as a required query parameter for this shop-list endpoint creates the same credential exposure risk as the other endpoints. Because this is generated operational documentation for an agent skill, implementers may copy the pattern directly into automation, amplifying accidental secret leakage.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Remediation Suggestions

SkillSpector

Direct Prompt Extraction

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Undeclared Tool Scope

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings