Security audit

TikTok Post Details API

Security checks for vulnerabilities and agentic risk

Overview

This skill is narrowly aimed at fetching TikTok post details, but it handles the required API token in ways that can expose it through command arguments and request URLs.

Install only if you are comfortable using a JustOneAPI token with this skill. Prefer a narrowly scoped or short-lived token, avoid running it in environments that log process arguments or full URLs, and rotate the token if it may have appeared in logs or telemetry.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: bin/run.mjs:31
Finding: API credential exposed in URL query parameters
Content: View full analysis
item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } ``` ### Technical Analysis The Skill sends the JustOneAPI credential as a URL query parameter. HTTPS protects the request from passive network interception, and the destination is restricted to the declared `https://api.justoneapi.com` service. However, URL query strings are commonly retained by reverse proxies, API gateways, request tracing systems, access logs, monitoring products, and diagnostic tooling. Sending a credential to the declared API is necessary for the Skill's function, but placing that credential in the URL creates exposure beyond the minimum necessary. Authentication headers are generally less likely to be recorded than complete request URLs. The generated OpenAPI metadata also defines the token as a ...[truncated 1170 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:38
Finding: API credential exposed through command-line arguments
Content: View full analysis
"}' ``` The helper explicitly receives the secret through the argument parser: ```js if (flag === "--token") { parsed.token = value; index += 1; continue; } ``` ### Technical Analysis Although the token initially resides in `JUST_ONE_API_TOKEN`, the documented command expands it into the Node process argument vector. Depending on operating-system configuration and execution environment, command-line arguments may be visible through process inspection utilities, process accounting, audit systems, container telemetry, endpoint monitoring, job metadata, or diagnostic captures. The Skill does not intentionally print the token, and its error responses do not include the constructed request URL. Nevertheless, passing the secret as `--token` creates an avoidable local disclosure channel. The helper already declares `JUST_ONE_API_TOKEN` as its primary required environment variable, so it can read that variable directly without exposing its value in command-line arguments. Exploitation requires local process visibility or access to telemetry that records process arguments. ### Attack Path 1. A user follows the documented command and invokes the helper with `--token "$JUST_ONE_API_TOKEN"`. 2. The shell expands the environment variable before creating the Node process. 3. The plaintext token becomes part of the process argument vector. 4. A local observer, privileged process monitor, audit agent, or telemetry system captures the command-line arguments. 5. The observer extracts the token. 6. The token is reused to make unauthorized ...[truncated 560 chars]
Remediation: View remediation
"}' ``` 3. Remove `--token` support, or retain it only as a deprecated fallback with a prominent warning. 4. For environments requiring stronger secret handling, support reading the token from a protected file descriptor or secret manager. 5. Restrict process and telemetry visibility, redact command-line data in monitoring systems, and rotate any token suspected of having appeared in historical process records. ]]>

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill invokes a network-capable helper (node .../bin/run.mjs) and requires an API token, but it does not explicitly declare a tool scope such as permissions or allowed-tools. That mismatch can undermine platform-level least-privilege controls, making it easier for the skill to perform outbound requests without clear policy gating or user/operator visibility.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: This is a manifest-style JSON file, so vague-trigger review applies. The description and operation summary explain what the skill does but do not define when it should or should not be invoked, provide explicit trigger phrases, or include exclusion conditions, which can make routing overly broad for generic requests about TikTok posts.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 63% confidence
Finding: The file’s user-facing descriptions are written only in English and do not mention any language choice or locale handling. If this skill is intended for broader organizational use, the lack of opt-in or documented locale constraints may conflict with language-choice policy expectations.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.