ClawHub
Back to skill

Security audit

Social Media API

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent JustOneAPI social media search skill, but it handles the API token in ways that can expose it through command lines and logged URLs.

Install only if you are comfortable sending social-media search terms and a JustOneAPI token to api.justoneapi.com. Use a low-privilege, revocable token, avoid sensitive searches, and rotate the token if command logs or full request URLs may be retained.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
bin/run.mjs:241
Finding

API access token transmitted in the URL query string

Content
View full analysis

Vulnerability Details

File Location: bin/run.mjs, lines 21–29, 109–111, 224–231, and 241–248
Vulnerability Type: Credential exposure through URL query parameters
Risk Level: Medium

Vulnerable Code

The operation declares the access token as a query parameter:

js
      {
        "defaultValue": null,
        "description": "Access token for this API service.",
        "enumValues": [],
        "location": "query",
        "name": "token",
        "required": true,
        "schemaType": "string"
      },

The supplied token is inserted into the parameter object:

js
const params = parseParams(args.paramsJson);
applyDefaults(operation, params);
injectToken(operation, params, args.token);
validateRequired(operation, params);

All declared query parameters, including token, are then appended to the request URL:

js
function applyQueryParams(operation, params, url) {
  for (const parameter of operation.parameters.filter((item) => item.location === "query")) {
    const value = params[parameter.name];
    if (value === undefined) {
      continue;
    }
    appendValue(url.searchParams, parameter.name, value);
  }
}
js
function appendValue(searchParams, name, value) {
  if (Array.isArray(value)) {
    for (const item of value) {
      appendValue(searchParams, name, item);
    }
    return;
  }
  if (value && typeof value === "object") {
    searchParams.append(name, JSON.stringify(value));
    return;
  }
  searchParams.append(name, String(value));
}

Technical Analysis

The helper sends the JustOneAPI access token as part of the URL for an HTTPS GET request. HTTPS protects the URL while it is in transit, but it does not prevent the complete URL from being recorded at endpoints or trusted intermediaries. Reverse proxies, API gateways, server access logs, monitoring agents, browser-like diagnostics, an ...[truncated 1441 chars]

Remediation
View remediation

Remediation Suggestions

  1. Modify the API integration to send credentials in an HTTP authorization header, preferably using a short-lived bearer token:
    js
    const requestInit = {
  headers: {
    accept: "application/json",
    authorization: `Bearer ${token}`,
  },
  method: operation.method,
};
  2. Remove token from the operation's query parameters and ensure it is never added to URL.searchParams.
  3. If JustOneAPI only supports query-string authentication, request support for header-based authentication. Until then:
    • Use short-lived and narrowly scoped tokens.
    • Configure gateways, proxies, servers, and monitoring tools to redact the token parameter.
    • Disable full-URL logging where practical.
    • Rotate any token suspected of appearing in logs.
    • Restrict access to retained request and diagnostic logs.
  4. Add automated tests asserting that serialized request URLs never contain token values.

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:37
Finding

API access token exposed through process command-line arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 37–39
Vulnerability Type: Sensitive credential passed through process arguments
Risk Level: Low

Vulnerable Code

bash
node {baseDir}/bin/run.mjs --operation "<operation-id>" --token "$JUST_ONE_API_TOKEN" --params-json '{"key":"value"}'

Technical Analysis

The documented invocation expands JUST_ONE_API_TOKEN into the value of the --token command-line argument. Depending on the operating system, process isolation settings, execution framework, and telemetry configuration, command-line arguments may be visible through process inspection interfaces or recorded by shell tracing, audit systems, process monitors, job runners, and observability products.

The Skill already declares JUST_ONE_API_TOKEN as its required environment variable. Converting that value into an argument is unnecessary and expands the number of locations in which the secret can appear.

Attack Path

  1. The agent starts the helper using the documented command.
  2. The shell expands $JUST_ONE_API_TOKEN into the process argument vector.
  3. A same-host user, process-monitoring agent, audit system, or execution telemetry service captures the command line while the helper is running or from retained logs.
  4. An actor with access to that information extracts the token.
  5. The actor reuses the token against JustOneAPI.

Exploitation depends on local process visibility or access to command-execution telemetry; it is not remotely exploitable through the helper alone.

Impact Assessment

Exposure would allow use of the JustOneAPI account capabilities granted to the token, including unauthorized searches, quota consumption, and potentially billable activity. The scope is limited to the token's server-side permissions. No local privilege escalation, persistence, or arbitrary code execution was identified.

Remediation
View remediation

Remediation Suggestions

  1. Remove the --token option from the documented command:
    bash
    node {baseDir}/bin/run.mjs --operation "<operation-id>" --params-json '{"key":"value"}'
  2. Read the credential directly from the declared environment variable:
    js
    const token = process.env.JUST_ONE_API_TOKEN;
  3. Fail safely when the environment variable is absent, without including its value in error output.
  4. Ensure shell tracing and command logging are disabled around secret-bearing operations.
  5. Avoid printing the environment, request URL, or request headers in diagnostics.
  6. Rotate the token if command-line telemetry may already have retained it.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (10)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md
- Get a token from [Just One API Dashboard](https://dashboard.justoneapi.com/en/login?utm_source=clawhub.ai&utm_medium=referral&utm_campaign=justoneapi_search&utm_content=project_link).
- Authentication details: [Just One API Usage Guide](https://docs.justoneapi.com/en/?utm_source=clawhub.ai&utm_medium=referral&utm_campaign=justoneapi_search&utm_content=project_link).

## Output Rules

- Start with a plain-language answer tied to the Social Media task the user asked for.
- Include the most decision-relevant fields from the selected endpoint before dumping raw JSON.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bin/run.mjs (reported line 20)May include surrounding context.

js
"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

The API requires an access token in a query parameter, which is an unsafe credential-handling pattern because query strings are commonly logged by clients, proxies, servers, browser history, and monitoring tools. If exposed, the token could allow unauthorized use of the third-party service and potentially access associated account capabilities or billing.

Content

Scanner excerpt · generated/operations.json (reported line 14)May include surrounding context.

json
"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High
Category
Privilege Escalation
Confidence
96% confidence
Finding

This finding is a true credential-handling weakness because the skill defines a required 'token' parameter in the query string, which exposes authentication material in places that are routinely recorded or propagated. In the context of an agent skill, this is more dangerous because automated tooling may construct, log, retry, cache, or surface full request URLs, making token disclosure and reuse more likely.

Content

Scanner excerpt · generated/operations.md (reported line 17)May include surrounding context.

md
| Name | In | Required | Type | Default | Description |
| --- | --- | --- | --- | --- | --- |
| `token` | `query` | yes | `string` | n/a | Access token for this API service. |
| `keyword` | `query` | no | `string` | n/a | Search query string. Supports:
- Multiple keywords (AND): keyword1 keyword2
- Multiple keywords (OR): keyword1~keyword2

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill invokes a Node helper that performs authenticated external API requests, but the manifest does not declare an explicit tool scope such as allowed-tools or permissions. That creates an authorization gap where execution environments or reviewers cannot clearly constrain or audit network behavior, increasing the risk of unintended outbound access or token misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill sends the API access token as a URL query parameter, which is commonly exposed through logs, browser/history equivalents, proxy caches, monitoring systems, and upstream request tracing. Although the request uses HTTPS, query-string secrets are still more broadly propagated than headers, making accidental credential disclosure more likely in normal operation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest does not disclose that user-supplied search terms and an access token are sent to an external third-party API endpoint. This creates a data-transparency and consent problem: users or orchestrators may unknowingly transmit potentially sensitive queries and credentials off-platform, which increases privacy and misuse risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The operation requires an access token to be sent as a URL query parameter, and the documentation provides no warning about the risks. Query-string credentials are commonly exposed through server logs, browser history, referrer headers, monitoring tools, and shared URLs, increasing the chance of accidental credential leakage.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The file points users to /en/ dashboard and documentation URLs and all output instructions are written as if English is the required interaction language. There is no indication that users may choose another language or that English is required for a justified region-specific reason.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

This is a manifest JSON file, so vague-trigger checks apply. The top-level description broadly says the skill analyzes social media workflows and cross-platform search, but it does not define clear trigger phrases, boundaries, or exclusion conditions, which can make invocation criteria ambiguous.

Content

No source excerpt is available for this finding.