ClawHub
Back to skill

Security audit

Taobao and Tmall Product Search API

Security checks for vulnerabilities and agentic risk

Overview

This skill is a focused Taobao/Tmall product-search connector that uses a JustOneAPI token for its declared API call, with no evidence of hidden local access, persistence, or unrelated behavior.

Install only if you are comfortable giving this skill a JustOneAPI token for Taobao/Tmall product search. Treat the token as sensitive, prefer a narrowly scoped or replaceable token, avoid sharing command logs or screenshots, and rotate the token if you suspect it appeared in logs or process-monitoring output.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
bin/run.mjs:226
Finding

API Token Exposure Through Process Arguments and URL Query Parameters

Content
View full analysis

Vulnerability Details

File Location: bin/run.mjs:117-139, 226-236, 269-278; usage documented at SKILL.md:48
Vulnerability Type: API credential exposure through command-line arguments and query-string authentication
Risk Level: Medium

Vulnerable Code

SKILL.md:48:

bash
node {baseDir}/bin/run.mjs --operation "searchItemListV1" --token "$JUST_ONE_API_TOKEN" --params-json '{"keyword":"<keyword>"}'

bin/run.mjs:117-139:

js
injectToken(operation, params, args.token);
validateRequired(operation, params);

const baseUrl = manifest.baseUrl;
const url = new URL(operation.path, ensureBaseUrl(baseUrl));
applyPathParams(operation, params, url);
applyQueryParams(operation, params, url);

const requestInit = {
  headers: {
    "accept": "application/json",
  },
  method: operation.method,
};

if (operation.requestBody && params.body !== undefined) {
  requestInit.body = JSON.stringify(params.body);
  requestInit.headers["content-type"] = operation.requestBody.contentType || "application/json";
}

let response;
try {
  response = await fetch(url, requestInit);

bin/run.mjs:226-236:

js
function injectToken(operation, params, cliToken) {
  const tokenParam = operation.parameters.find((parameter) => parameter.name === "token");
  if (!tokenParam || params.token !== undefined) {
    return;
  }
  if (!cliToken) {
    fail("--token is required for this operation.", {
      operationId: operation.operationId,
    });
  }
  params.token = cliToken;
}

bin/run.mjs:269-278:

js
function applyQueryParams(operation, params, url) {
  for (const parameter of operation.parameters.filter((item) => item.location === "query")) {
    const value = params[parameter.name];
    if (value === undefined) {
      continue;
    }
    appendValue(url.searchParams, parameter.name, value);
  }
}

Technica

...[truncated 2962 chars]

Remediation
View remediation

Remediation Suggestions

  1. Stop passing secrets through command-line arguments. Read the credential directly from process.env.JUST_ONE_API_TOKEN and remove or deprecate --token.

    js
    function injectToken(operation, params) {
  const tokenParam = operation.parameters.find(
    (parameter) => parameter.name === "token"
  );

  if (!tokenParam || params.token !== undefined) {
    return;
  }

  const token = process.env.JUST_ONE_API_TOKEN;
  if (!token) {
    fail("JUST_ONE_API_TOKEN is required.", {
      operationId: operation.operationId,
    });
  }

  params.token = token;
}

  2. Prefer header-based authentication. If supported by JustOneAPI, remove token from query parameters and send it in the provider's documented authentication header, such as:

    js
    requestInit.headers.authorization = `Bearer ${token}`;

    The exact header and scheme must match the provider's official authentication specification.

  3. Prevent token injection through --params-json. Reject sensitive authentication fields supplied as ordinary parameters and source credentials only from the dedicated protected mechanism.

    js
    if (Object.prototype.hasOwnProperty.call(params, "token")) {
  fail('Do not provide "token" through --params-json.');
}

  4. If query authentication is mandatory, minimize secondary exposure. Never print or log the complete request URL, configure proxies and observability systems to redact the token query parameter, disable query-string capture where feasible, and apply short token lifetimes and narrowly scoped permissions.

  5. Update SKILL.md. Replace the --token example with an environment-only invocation and explicitly state that credentials must not be included in --params-json.

  6. Rotate potentially exposed credentials. Revoke and replace tokens previously used through c ...[truncated 109 chars]

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Credential Access

High
Category
Privilege Escalation
Confidence
96% confidence
Finding

The API requires an access token to be sent as a query parameter, which is an insecure credential transport pattern because query strings are commonly logged by clients, servers, proxies, analytics systems, and browser history. Even over HTTPS, this increases the chance of credential leakage and subsequent unauthorized use of the API service.

Content

Scanner excerpt · generated/operations.json (reported line 15)May include surrounding context.

json
"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bin/run.mjs (reported line 20)May include surrounding context.

js
| Name | In | Required | Type | Default | Description |
| --- | --- | --- | --- | --- | --- |
| `token` | `query` | yes | `string` | n/a | Access token for this API service. |
| `keyword` | `query` | yes | `string` | n/a | Search keyword. |
| `sort` | `query` | no | `string` | `_sale` | Sort order for the result set.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · generated/operations.md (reported line 19)May include surrounding context.

md
| Name | In | Required | Type | Default | Description |
| --- | --- | --- | --- | --- | --- |
| `token` | `query` | yes | `string` | n/a | Access token for this API service. |
| `keyword` | `query` | yes | `string` | n/a | Search keyword. |
| `sort` | `query` | no | `string` | `_sale` | Sort order for the result set.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill invokes a network-capable helper (node .../bin/run.mjs) and is clearly designed to make outbound API requests, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates a policy/visibility gap: a host or reviewer cannot easily constrain or audit the skill's external access based on the manifest alone, increasing the risk of unintended or overly broad network use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill places the API access token into the URL query string via standard query parameter handling. Query-string credentials are commonly exposed through logs, browser/history records, proxy/CDN access logs, monitoring tools, and error telemetry, which increases the chance of credential disclosure even when HTTPS is used. In this skill context, the token is a required secret for a third-party API, so transmitting it this way is unnecessarily risky.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

This JSON manifest describes the skill's purpose and name but does not specify when the skill should activate, what phrases should trigger it, or any exclusions. For manifest files, missing trigger specificity can lead to unintended invocation because the system has no clear boundaries for matching user requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

This markdown file documents a required token query parameter, which is a sensitive credential, but provides no warning about protecting the token, avoiding accidental exposure in logs or URLs, or treating it as sensitive data. Under the markdown-specific missing-warning rule, documentation should disclose privacy or security-relevant behavior when credentials are involved.

Content

No source excerpt is available for this finding.