ClawHub
Back to skill

Security audit

Reddit API

Security checks for vulnerabilities and agentic risk

Overview

This Reddit API skill matches its stated purpose, but it passes the API token through command-line arguments and URL query parameters, which can leak credentials through logs or process metadata.

Review before installing if the token has billing, quota, or broad JustOneAPI access. Use a narrowly scoped token if available, avoid sensitive Reddit search terms, and rotate the token if it may have appeared in logs or process captures.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
bin/run.mjs:306
Finding

API Credential Exposure Through URL Query Parameters and Process Arguments

Content
View full analysis

Vulnerability Details

File Location: bin/run.mjs:23-31, bin/run.mjs:278-286, bin/run.mjs:306-313; related invocation guidance at SKILL.md:41
Vulnerability Type: API credential exposure
Risk Level: Medium

Vulnerable Code

js
{
  "defaultValue": null,
  "description": "Access token for this API service.",
  "enumValues": [],
  "location": "query",
  "name": "token",
  "required": true,
  "schemaType": "string"
}
js
function injectToken(operation, params, cliToken) {
  const tokenParam = operation.parameters.find((parameter) => parameter.name === "token");
  if (!tokenParam || params.token !== undefined) {
    return;
  }
  if (!cliToken) {
    fail("--token is required for this operation.", {
      operationId: operation.operationId,
    });
  }
  params.token = cliToken;
}
js
function applyQueryParams(operation, params, url) {
  for (const parameter of operation.parameters.filter((item) => item.location === "query")) {
    const value = params[parameter.name];
    if (value === undefined) {
      continue;
    }
    appendValue(url.searchParams, parameter.name, value);
  }
}

The documented invocation also passes the credential as a command-line argument:

bash
node {baseDir}/bin/run.mjs --operation "<operation-id>" --token "$JUST_ONE_API_TOKEN" --params-json '{"key":"value"}'

Technical Analysis

The Skill inserts JUST_ONE_API_TOKEN into URL.searchParams, resulting in requests whose URLs contain the credential as a token query parameter. HTTPS protects the request from ordinary passive network interception, but it does not prevent the complete URL from being recorded by the destination service, API gateways, reverse proxies, access logs, observability platforms, debugging tools, or error telemetry.

The prescribed command also supplies the secret through --token. Command-line arguments may be vi ...[truncated 1994 chars]

Remediation
View remediation

Remediation Suggestions

  1. Read the credential directly from process.env.JUST_ONE_API_TOKEN rather than accepting it through --token.

  2. If supported by JustOneAPI, transmit the credential in an HTTP authorization header:

    js
    const token = process.env.JUST_ONE_API_TOKEN;
if (!token) {
  fail("JUST_ONE_API_TOKEN is required.");
}

const requestInit = {
  method: operation.method,
  headers: {
    accept: "application/json",
    authorization: `Bearer ${token}`,
  },
};

  3. Remove token from operation query-parameter definitions and prevent callers from supplying a token through --params-json.

  4. Update SKILL.md so the invocation does not include a secret-bearing command-line argument.

  5. If the provider only supports query-string authentication:

    • Retrieve the token directly from the environment.
    • Configure clients, proxies, gateways, servers, and observability systems to redact the token parameter.
    • Disable storage of complete query strings where possible.
    • Ensure errors and diagnostics never include the complete request URL.
    • Use narrowly scoped, short-lived tokens and implement routine rotation.

  6. Revoke and replace any token suspected of appearing in process captures, URL logs, or telemetry.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (14)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md
- Get a token from [Just One API Dashboard](https://dashboard.justoneapi.com/en/login?utm_source=clawhub.ai&utm_medium=referral&utm_campaign=justoneapi_reddit&utm_content=project_link).
- Authentication details: [Just One API Usage Guide](https://docs.justoneapi.com/en/?utm_source=clawhub.ai&utm_medium=referral&utm_campaign=justoneapi_reddit&utm_content=project_link).

## Output Rules

- Start with a plain-language answer tied to the Reddit task the user asked for.
- Include the most decision-relevant fields from the selected endpoint before dumping raw JSON.

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

The skill requires an access token and sends it as a URL query parameter. Query-string secrets are commonly exposed through logs, browser/history artifacts, reverse proxies, monitoring systems, and error messages, which makes credential leakage significantly more likely than using an Authorization header or request body. In this skill context, the risk is elevated because every supported operation embeds the token into outbound requests in a consistent, repeatable way.

Content

Scanner excerpt · bin/run.mjs (reported line 20)May include surrounding context.

js
"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

This operation definition also marks the access token as a required query parameter, meaning the credential will be appended to the URL and transmitted in places that are often broadly logged or retained. Exposing API secrets in URLs increases the chance of accidental disclosure and token reuse by unauthorized parties. Because this is an API-integration skill, the dangerous pattern is part of normal operation rather than an edge case.

Content

Scanner excerpt · bin/run.mjs (reported line 66)May include surrounding context.

js
"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

The search endpoint repeats the same insecure credential-handling pattern by requiring the access token in the query string. If URLs are logged by the client, gateway, upstream service, or observability stack, the token may be exposed and then abused to access the API service. The skill context makes this more dangerous because search operations are likely to be used frequently, increasing the number of opportunities for leakage.

Content

Scanner excerpt · bin/run.mjs (reported line 103)May include surrounding context.

js
"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · generated/operations.json (reported line 14)May include surrounding context.

json
"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · generated/operations.json (reported line 60)May include surrounding context.

json
"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · generated/operations.json (reported line 97)May include surrounding context.

json
"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

This finding documents a required access token passed as a query parameter, which is an unsafe credential transport pattern. If used as documented, the token can be captured by intermediary infrastructure or operational logs and then reused to access the API service.

Content

Scanner excerpt · generated/operations.md (reported line 17)May include surrounding context.

md
| Name | In | Required | Type | Default | Description |
| --- | --- | --- | --- | --- | --- |
| `token` | `query` | yes | `string` | n/a | Access token for this API service. |
| `postId` | `query` | yes | `string` | n/a | The unique identifier of the Reddit post. |
| `cursor` | `query` | no | `string` | n/a | Pagination token for the next page of results. |

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The same insecure pattern appears for the post detail endpoint: the API requires an access token in the query string. Because this skill is an API integration guide, users are likely to copy this exact usage, which amplifies the chance of broad credential exposure across client code and logs.

Content

Scanner excerpt · generated/operations.md (reported line 41)May include surrounding context.

md
| Name | In | Required | Type | Default | Description |
| --- | --- | --- | --- | --- | --- |
| `token` | `query` | yes | `string` | n/a | Access token for this API service. |
| `postId` | `query` | yes | `string` | n/a | The unique identifier of the Reddit post (e.g., 't3_1q4aqti'). |

### Request body

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The search endpoint also requires an access token in the query string, repeating the same credential exposure issue across the skill. Repetition across multiple operations makes the risk more dangerous because every integration path inherits the insecure pattern and increases the token exposure surface.

Content

Scanner excerpt · generated/operations.md (reported line 64)May include surrounding context.

md
| Name | In | Required | Type | Default | Description |
| --- | --- | --- | --- | --- | --- |
| `token` | `query` | yes | `string` | n/a | Access token for this API service. |
| `keyword` | `query` | yes | `string` | n/a | Search query keywords. |
| `after` | `query` | no | `string` | n/a | Pagination token to retrieve the next set of results. |

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill explicitly instructs the agent to run a Node helper that performs authenticated external API requests, but it does not declare any tool scope such as allowed-tools or permissions. That mismatch weakens policy enforcement and reviewability, because an execution environment may allow broader networked code behavior than the manifest makes explicit. In this context, the risk is moderate rather than severe because the documented behavior is limited to a single API use case and does not itself contain overt exfiltration logic.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The API access token is defined as a required query parameter, which is routinely exposed in browser history, intermediary logs, analytics systems, reverse proxies, and error traces even when HTTPS is used. This increases the chance of credential leakage and unauthorized reuse of the token by anyone with access to those records.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documentation specifies an access token in the URL query string without any warning about secure handling. Query parameters are commonly exposed in logs, browser history, analytics, reverse proxies, and referrer headers, so encouraging this pattern increases the likelihood of credential leakage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill description does not clearly warn users that their search keywords, Reddit post identifiers, and related requests are sent to a third-party external API service. This creates a transparency and privacy risk because users may unknowingly disclose sensitive research terms, moderation targets, or internal investigation subjects to the provider.

Content

No source excerpt is available for this finding.