Kuaishou Video Comments API

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:29 AM UTC
• Version: 1.0.0

Overview

This is a narrow API wrapper, but it handles the user's JustOneAPI token in ways that can expose it through command arguments and URL query strings.

Review before installing if you are not comfortable with your JustOneAPI token appearing in a command-line argument and URL query string. Use a narrowly scoped token if possible, avoid shell tracing or logging full commands/URLs, and rotate the token if you suspect it was logged.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: bin/run.mjs:20

Finding

API Token Exposed Through Process Arguments and URL Query Parameters

Content

View full analysis

Vulnerability Details

File Location: bin/run.mjs:20-24, 153-155, 186-195, 228-235; usage documented in SKILL.md:42, 50
Vulnerability Type: Credential exposure through command-line arguments and URL query parameters
Risk Level: Medium

Vulnerable Code

javascript

{
  "defaultValue": null,
  "description": "Access token for this API service.",
  "enumValues": [],
  "location": "query",
  "name": "token",
  "required": true,
  "schemaType": "string"
}

javascript

if (flag === "--token") {
  parsed.token = value;
  index += 1;
  continue;
}

javascript

function injectToken(operation, params, cliToken) {
  const tokenParam = operation.parameters.find((parameter) => parameter.name === "token");
  if (!tokenParam || params.token !== undefined) {
    return;
  }
  if (!cliToken) {
    fail("--token is required for this operation.", {
      operationId: operation.operationId,
    });
  }
  params.token = cliToken;
}

javascript

function applyQueryParams(operation, params, url) {
  for (const parameter of operation.parameters.filter((item) => item.location === "query")) {
    const value = params[parameter.name];
    if (value === undefined) {
      continue;
    }
    appendValue(url.searchParams, parameter.name, value);
  }
}

The documented invocation also passes the secret as a command-line argument:

bash

node {baseDir}/bin/run.mjs --operation "getVideoCommentsV1" --token "$JUST_ONE_API_TOKEN" --params-json '{"videoId":"<videoId>"}'

Technical Analysis

The access token is first supplied through the --token command-line argument. Command-line arguments may be observable by other local users or monitoring software through process inspection facilities, shell tracing, job-control systems, audit logs, and process telemetry.

The token is then assigned to params.token. Because the operation man ...[truncated 2086 chars]

Remediation

View remediation

Remediation Suggestions

1. Use an authentication header: If supported by JustOneAPI, remove token from the query schema and transmit it through an authorization header, such as:

   javascript

   const token = process.env.JUST_ONE_API_TOKEN;
   if (!token) {
     fail("JUST_ONE_API_TOKEN is required.");
   }
   
   const requestInit = {
     headers: {
       "accept": "application/json",
       "authorization": `Bearer ${token}`,
     },
     method: operation.method,
   };
   

2. Read the token directly from the environment: Avoid accepting reusable secrets through command-line arguments. Read process.env.JUST_ONE_API_TOKEN inside the process so the secret does not appear in the documented command line.

3. Reject token overrides in parameter JSON: Prevent callers from supplying token through --params-json, which would otherwise continue to place the credential in the URL.

4. Redact sensitive values: Ensure request URLs, exception details, telemetry, and backend diagnostics never include an unredacted token parameter. Implement centralized redaction before logging URLs or request metadata.

5. If query authentication is unavoidable: Clearly document the residual exposure, disable full-URL logging where possible, configure proxies and observability systems to redact the token parameter, use narrowly scoped short-lived tokens, and rotate any token suspected of being logged.

6. Update documentation: Replace the --token example in SKILL.md with an environment-only invocation and explain the credential-handling protections.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bin/run.mjs (reported line 20)May include surrounding context.

js

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · generated/operations.md (reported line 24)May include surrounding context.

md

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The operation explicitly collects an access token and places it in a request parameter, which creates credential exposure risk if the agent, platform, or downstream tooling mishandles requests. In this context, the danger is amplified because the token is used to access a third-party API service and may be recoverable from request logs or telemetry.

Content

Scanner excerpt · generated/operations.json (reported line 15)May include surrounding context.

json

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The CLI places the API token into the request query string, which commonly gets recorded in logs, browser/history equivalents, reverse proxies, monitoring systems, and upstream service telemetry. Even though the request is sent over HTTPS, query-parameter secrets have a broader exposure surface than headers and there is no warning to the user that invoking the tool may disclose the token in process arguments, logs, or backend access logs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill requires a sensitive API token as a query parameter but provides no warning about secure handling, logging exposure, or avoiding disclosure to users. Query parameters are commonly captured in logs, traces, browser history, and intermediary systems, increasing the chance of credential leakage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file documents a required token parameter for accessing the API service, but it does not include any warning about handling credentials, privacy, or the risks of exposing tokens. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors affecting user data or privacy, and credential use falls into that scope.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

This manifest-style JSON describes what the skill does but provides no specific activation phrases, scope limits, or exclusion conditions. For manifest files, the absence of explicit trigger constraints can make invocation behavior overly broad or ambiguous in systems that infer routing from descriptions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.