Kuaishou User Search API

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:07 AM UTC
• Version: 1.0.0

Overview

This skill appears to be a focused Kuaishou user-search API wrapper, but it handles the JustOneAPI token in ways that can expose it through command lines and URL query strings.

Review this before installing if your JustOneAPI token has billing, quota, or sensitive data access. Use a least-privilege, easily rotated token, avoid sensitive search terms where possible, and assume the token may appear in local process metadata and service-side URL logs until the skill uses safer secret handling.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: bin/run.mjs:18

Finding

API Token Exposed Through Process Arguments and URL Query Parameters

Content

View full analysis

Vulnerability Details

File Location: bin/run.mjs:18-26, 68-76, 145-158, 174-181, 211-220; supporting usage in SKILL.md:41, 49
Vulnerability Type: Sensitive credential exposure
Risk Level: Medium

Vulnerable Code

js

{
  "description": "Access token for this API service.",
  "location": "query",
  "name": "token",
  "required": true,
  "schemaType": "string"
}

js

const params = parseParams(args.paramsJson);
applyDefaults(operation, params);
injectToken(operation, params, args.token);
validateRequired(operation, params);

const baseUrl = manifest.baseUrl;
const url = new URL(operation.path, ensureBaseUrl(baseUrl));
applyPathParams(operation, params, url);
applyQueryParams(operation, params, url);

js

if (flag === "--token") {
  parsed.token = value;
  index += 1;
  continue;
}

js

function injectToken(operation, params, cliToken) {
  const tokenParam = operation.parameters.find((parameter) => parameter.name === "token");
  if (!tokenParam || params.token !== undefined) {
    return;
  }
  if (!cliToken) {
    fail("--token is required for this operation.", {
      operationId: operation.operationId,
    });
  }
  params.token = cliToken;
}

js

function applyQueryParams(operation, params, url) {
  for (const parameter of operation.parameters.filter((item) => item.location === "query")) {
    const value = params[parameter.name];
    if (value === undefined) {
      continue;
    }
    appendValue(url.searchParams, parameter.name, value);
  }
}

The documented invocation also places the credential in a command-line argument:

bash

node {baseDir}/bin/run.mjs --operation "searchKuaishouUserV2" --token "$JUST_ONE_API_TOKEN" --params-json '{"keyword":"<keyword>"}'

Technical Analysis

The helper accepts the API credential through --token, making the secret part of the Node process command line. Depending on operating-system policy and execution environment, process arguments may be observable ...[truncated 2304 chars]

Remediation

View remediation

Remediation Suggestions

1. Read the token directly from process.env.JUST_ONE_API_TOKEN instead of requiring --token, so it does not appear in process arguments.
2. Remove or deprecate support for supplying token through --params-json; otherwise users can still place the credential in process arguments.
3. Prefer an authorization header when supported by the upstream service:

js

const token = process.env.JUST_ONE_API_TOKEN;
if (!token) {
  fail("JUST_ONE_API_TOKEN is required.");
}

const requestInit = {
  method: operation.method,
  headers: {
    accept: "application/json",
    authorization: `Bearer ${token}`,
  },
};

4. Remove token from the query-parameter manifest when header authentication is available.
5. If JustOneAPI only accepts query-string authentication, document this residual risk and configure clients, proxies, gateways, application logs, tracing systems, and error-reporting tools to redact the token parameter.
6. Ensure errors never include complete request URLs and add automated tests verifying that credentials do not appear in standard output, standard error, or diagnostic messages.
7. Use narrowly scoped, short-lived tokens where supported. Apply rate limits, usage alerts, rotation procedures, and prompt revocation for suspected exposure.
8. Update SKILL.md to instruct users to provide the credential only through the environment and never through command-line arguments or parameter JSON.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bin/run.mjs (reported line 20)May include surrounding context.

js

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The operation explicitly requests an access token, creating a credential-handling surface. In this context the skill is an API wrapper, so asking for authentication is expected, but collecting and transmitting the token through a URL query parameter makes credential leakage significantly more likely and could enable unauthorized API use if exposed.

Content

Scanner excerpt · generated/operations.json (reported line 15)May include surrounding context.

json

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Requiring an access token in a query parameter is a real credential-handling weakness because URLs are frequently persisted in logs, caches, referrers, and debugging tools. If the token is exposed, an attacker could reuse it to access the API service and perform unauthorized actions or data retrieval within the token's scope.

Content

Scanner excerpt · generated/operations.md (reported line 19)May include surrounding context.

md

| Name | In | Required | Type | Default | Description |
| --- | --- | --- | --- | --- | --- |
| `token` | `query` | yes | `string` | n/a | Access token for this API service. |
| `keyword` | `query` | yes | `string` | n/a | The search keyword to find users. |
| `page` | `query` | no | `integer` | `1` | Page number for results, starting from 1. |

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill invokes a network-capable helper (node .../bin/run.mjs) that calls an external API, but the manifest does not declare an explicit tool scope such as permissions or allowed-tools. This creates an authorization gap where an agent runtime may permit broader-than-intended outbound access or make network use insufficiently visible to reviewers, increasing the risk of unintended data exfiltration or misuse of the configured API token.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly places the API access token in a query parameter and then sends it in the request URL. Query-string credentials are commonly exposed via logs, proxies, browser/history-like tooling, monitoring systems, and error telemetry, which increases the chance of accidental credential disclosure even when HTTPS is used.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill requires an access token as a query parameter without any user-facing warning or safer handling guidance. Query parameters are commonly logged by clients, proxies, and servers, which increases the chance of accidental credential exposure during normal use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation specifies that both the access token and the user search keyword are sent as query parameters, but it does not warn that query strings are commonly logged by clients, proxies, gateways, browser history, and monitoring systems. This can expose credentials and potentially sensitive search terms even when the endpoint itself is otherwise legitimate.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This manifest describes the skill as searching Kuaishou users "with keyword," but it does not define any explicit trigger phrases, scope constraints, or exclusion conditions for when the skill should be invoked. In a manifest file, this broad natural-language description can contribute to unintended activation because it lacks specificity about what user requests should or should not match.

Content

No source excerpt is available for this finding.