TikTok Post Comments API

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:07 AM UTC
• Version: 1.0.0

Overview

This is a focused JustOneAPI wrapper for one TikTok comments endpoint, with a real but disclosed token-handling risk users should manage carefully.

Install only if you are comfortable giving this skill a JustOneAPI token for TikTok comment lookups. Use a narrowly scoped, revocable token where possible, avoid sharing command lines or logs that include it, and rotate the token if it may have appeared in process logs or URL logs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: bin/run.mjs:164

Finding

API Credential Exposed Through Command-Line Arguments and URL Query Parameters

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:37, SKILL.md:44, bin/run.mjs:164-177, bin/run.mjs:210-217
Vulnerability Type: API credential exposure
Risk Level: Medium

The documented invocation passes the JustOneAPI token as a command-line argument:

bash

node {baseDir}/bin/run.mjs --operation "getPostCommentV1" --token "$JUST_ONE_API_TOKEN" --params-json '{"awemeId":"<awemeId>"}'

The executable then injects that credential into the request parameters:

js

function injectToken(operation, params, cliToken) {
  const tokenParam = operation.parameters.find((parameter) => parameter.name === "token");
  if (!tokenParam || params.token !== undefined) {
    return;
  }
  if (!cliToken) {
    fail("--token is required for this operation.", {
      operationId: operation.operationId,
    });
  }
  params.token = cliToken;
}

Because the manifest defines token as a query parameter, the following code places the credential in the request URL:

js

function applyQueryParams(operation, params, url) {
  for (const parameter of operation.parameters.filter((item) => item.location === "query")) {
    const value = params[parameter.name];
    if (value === undefined) {
      continue;
    }
    appendValue(url.searchParams, parameter.name, value);
  }
}

Technical Analysis

The token is exposed through two sensitive channels:

1. Passing it through --token places it in the process argument vector. Depending on operating-system permissions and deployment configuration, command arguments may be visible through process inspection, execution auditing, monitoring agents, or command logging.
2. Adding it to URL.searchParams produces a URL containing ?token=.... Although HTTPS encrypts the request in transit, full URLs can still be retained by API gateways, reverse proxies, server access logs, observability systems, error reports, or redirect ha ...[truncated 1541 chars]

Remediation

View remediation

Remediation Suggestions

1. Read JUST_ONE_API_TOKEN directly from process.env rather than requiring the secret through --token:

   js

   const token = process.env.JUST_ONE_API_TOKEN;
   

   Remove or deprecate the command-line token option so credentials do not appear in the process argument vector.

2. If supported by JustOneAPI, transmit the credential in an authorization header:

   js

   requestInit.headers.authorization = `Bearer ${token}`;
   

   Update the API contract and manifest so token is not treated as a query parameter.

3. If the upstream service strictly requires query-string authentication:

   • Never log the complete request URL.
   • Redact token from application, proxy, gateway, monitoring, tracing, and error logs.
   • Disable automatic cross-origin redirects or ensure credentials are removed before following redirects.
   • Configure the shortest practical log-retention period and restrict access to infrastructure logs.
   • Rotate the token immediately if URL or process records may already have exposed it.

4. Use narrowly scoped, revocable credentials with rate and spending limits where supported. Maintain separate tokens for development and production.

5. Update SKILL.md to document environment-based token loading and explicitly prohibit passing secrets through command-line arguments or params-json.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill invokes a network-capable helper (node {baseDir}/bin/run.mjs) that can send requests to an external API, but the manifest does not declare an explicit tool scope such as permissions or allowed-tools. That mismatch weakens policy enforcement and reviewability, because a host may permit behavior the manifest does not transparently disclose, increasing the risk of unexpected outbound requests and data exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill accepts the API token via the command line and then places it into the URL query string as the required token parameter. This exposes the secret through shell history, process listings, logs, monitoring systems, and intermediary HTTP infrastructure that commonly records full URLs, making accidental credential disclosure significantly more likely even though the transport is HTTPS.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The API token is modeled as a required query parameter, which increases the chance of credential exposure through URL logging, browser history, proxy logs, analytics systems, and referrer leakage. In this skill context, the risk is real because the token is an authentication secret for a third-party API and the OpenAPI definition provides no warning or safer authentication mechanism, making accidental disclosure more likely.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.