Social Media Cross-Platform Search API

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:26 AM UTC
• Version: 1.0.0

Overview

The skill is a focused JustOneAPI social-media search wrapper, but it exposes the API token through command-line arguments and URL query parameters.

Install only if you are comfortable sending searches and a JustOneAPI token to api.justoneapi.com. Use a narrowly scoped or short-lived token where possible, avoid sensitive search terms, and prefer a publisher update that reads secrets directly from the environment and authenticates via a header instead of URL query parameters.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: bin/run.mjs:238

Finding

API Token Exposed in the Request URL Query String

Content

View full analysis

item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } ``` ### Technical Analysis The operation metadata classifies the API token as a query parameter. `applyQueryParams` consequently appends the credential to the URL before `fetch` sends the request. The resulting request has the following effective form: ```text https://api.justoneapi.com/api/search/v1?token=&keyword= ``` TLS protects the request from passive observation while it is transmitted over the network, but it does not prevent the complete URL from being recorded at either endpoint or by trusted infrastructure. Full URLs are frequently captured by reverse-proxy access logs, API gateways, application performance monitoring systems, server diagnostics, error telemetry, and network debugging tools. Sending a reusable credential in a URL therefore gives the token a wider exposure surface than sending it in a dedicated authentication header. The behavior is associated with the declared API request and is not evidence of covert exfiltration, but it does not follow least-exposure credential handling. ### A ...[truncated 1333 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: bin/run.mjs:166

Finding

API Token Exposed Through Command-Line Arguments

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bin/run.mjs (reported line 20)May include surrounding context.

js

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The API requires an access token as a query parameter, which is a dangerous credential handling pattern because query strings are commonly captured in logs, browser history, proxies, analytics, and monitoring systems. If exposed, the token could allow unauthorized use of the external API and potentially leak usage patterns or incur financial and account impact.

Content

Scanner excerpt · generated/operations.json (reported line 15)May include surrounding context.

json

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The API requires an access token to be sent in the query string, which is a risky credential-handling pattern. Query parameters are commonly captured in logs, browser history, analytics systems, reverse proxies, and referrer headers, increasing the chance of token leakage and unauthorized API access.

Content

Scanner excerpt · generated/operations.md (reported line 19)May include surrounding context.

md

| Name | In | Required | Type | Default | Description |
| --- | --- | --- | --- | --- | --- |
| `token` | `query` | yes | `string` | n/a | Access token for this API service. |
| `keyword` | `query` | no | `string` | n/a | Search query string. Supports:
- Multiple keywords (AND): keyword1 keyword2
- Multiple keywords (OR): keyword1~keyword2

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill invokes a network-capable helper (node .../run.mjs) and is explicitly designed to call a remote API, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates an authorization gap where the runtime may permit broader network/tool use than reviewers or policy engines can easily validate, increasing the risk of unintended outbound requests or abuse if the skill is modified or composed with other behaviors.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill appends the API token into the URL query string, which can expose credentials through logs, browser/history equivalents, proxy caches, monitoring systems, and upstream services that record full URLs. Even though the request uses HTTPS, query parameters are routinely surfaced in operational telemetry, making token leakage materially more likely than using an Authorization header.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is designed to send user-provided search terms and an API access token to an external third-party endpoint, yet the manifest provides no user-facing disclosure or consent boundary about external transmission. This creates a privacy and trust risk because sensitive search intent, investigation topics, or credentials could be sent off-platform without the user clearly understanding that data leaves the local agent environment.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This is a manifest file, so vague-trigger checks apply. The skill identity fields only provide a generic search-oriented name and slug, but do not specify invocation scope, exclusions, or narrow activation conditions, which can lead to unintended activation for broad 'search' requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The description hardcodes use of Chinese social-media platforms and labels such as Douyin and WeChat, but does not state whether this skill is intended only for a China-specific context or offer any locale/user choice. Under the language/locale policy rule, locale constraints should be explicit and justified rather than implicit.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.