Security audit

TikTok Post Search API

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent TikTok search integration, but it handles the JustOneAPI token in ways that can expose the credential more broadly than users may expect.

Review this before installing if your JustOneAPI token has paid quota or broad permissions. Use a narrowly scoped token if available, avoid sensitive keywords, and be aware that the token is passed in process arguments and request URLs where local diagnostics or service logs may record it.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: bin/run.mjs:115
Finding: API Credential Exposed Through Process Arguments and URL Query Parameters
Content: View full analysis
"}' ``` `bin/run.mjs:115-121` injects the token into the parameters and adds all query parameters to the URL: ```js const params = parseParams(args.paramsJson); applyDefaults(operation, params); injectToken(operation, params, args.token); validateRequired(operation, params); const baseUrl = manifest.baseUrl; const url = new URL(operation.path, ensureBaseUrl(baseUrl)); applyPathParams(operation, params, url); applyQueryParams(operation, params, url); ``` `bin/run.mjs:235-247` copies the command-line token into the operation parameters: ```js function injectToken(operation, params, cliToken) { const tokenParam = operation.parameters.find((parameter) => parameter.name === "token"); if (!tokenParam || params.token !== undefined) { return; } if (!cliToken) { fail("--token is required for this operation.", { operationId: operation.operationId, }); } params.token = cliToken; } ``` `bin/run.mjs:253-263` appends query-located parameters, including `token`, to the outbound URL: ```js function applyQueryParams(operation, params, url) { for (const parameter of operation.parameters.filter((item) => item. ...[truncated 3155 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill invokes a network-capable helper (node {baseDir}/bin/run.mjs) and performs external API calls, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates a trust and policy gap: a host agent or reviewer cannot easily determine from the manifest what capabilities the skill needs, increasing the risk of unintended network access or capability abuse if the skill is executed in a permissive environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The manifest requires sending a sensitive API token as a query parameter to a third-party service, and query parameters are more likely to be logged in clients, proxies, browser history, and server access logs. It also transmits user-supplied search terms externally without any disclosure or guidance on handling sensitive user input, increasing privacy and credential exposure risk.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: This JSON file is a manifest-style definition, so vague-trigger checks apply. The description states the skill works "with keyword" but does not define specific invocation phrases, scope limits, or exclusion conditions, leaving activation semantics underspecified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: Natural-language policy checks apply to all file types, including config values. Defaulting the region to US can bias results toward a specific locale, and the file does not indicate that the user can choose or that US is merely a convenience default with clear opt-in behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: This markdown file describes collecting TikTok post details for trend monitoring, content discovery, market analysis, and sentiment tracking, but it does not include any user-facing warning about potential privacy, platform-policy, or data-handling implications. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect user data or privacy.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.