TikTok Shop API

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:04 AM UTC
• Version: 1.0.6

Overview

The skill matches its TikTok Shop API purpose, but it handles the JustOneAPI token in command arguments and URL query strings where it may be captured in logs or process metadata.

Review before installing. Use only a narrowly scoped JustOneAPI token, avoid shell tracing or logging command invocations, and rotate the token if it may have appeared in process logs or full request URLs. The skill does not show hidden exfiltration or persistence, but its credential handling is weaker than expected for a reusable API integration.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: bin/run.mjs:219
• Finding: API Credential Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:40`; `bin/run.mjs:219-235` **Vulnerability Type**: API credential exposure through process arguments **Risk Level**: Medium ### Vulnerable Code `SKILL.md:40`: ```bash node {baseDir}/bin/run.mjs --operation "<operation-id>" --token "$JUST_ONE_API_TOKEN" --params-json '{"key":"value"}' ``` `bin/run.mjs:219-235`: ```js function parseArgs(argv) { const parsed = { operation: null, paramsJson: "{}", token: null }; for (let index = 0; index < argv.length; index += 1) { const flag = argv[index]; const value = argv[index + 1]; if (flag === "--operation") { parsed.operation = value; index += 1; continue; } if (flag === "--params-json") { parsed.paramsJson = value; index += 1; continue; } if (flag === "--token") { parsed.token = value; index += 1; continue; ``` ### Technical Analysis The documented invocation passes `JUST_ONE_API_TOKEN` as the value of the `--token` command-line argument. The helper then reads the credential directly from `process.argv`. Command-line arguments can be exposed through operating-system process inspection, process-monitoring software, execution telemetry, shell debugging, wrapper scripts, and improperly configured job systems. Expanding the environment variable in the shell does not protect it after expansion: the resulting secret becomes part of the Node.js process argument vector. Authentication is necessary for the Skill's declared TikTok Shop API functionality, but placing the credential in the argument vector creates avoidable exposure and is not a least-exposure credential-handling design. ### Attack Path 1. A user follows the documented command and invokes the helper with `--token "$JUST_ONE_API_TOKEN"`. 2. The shell expands the environment variable into the actual credential. 3. The credential becomes part of the Node.js process argument vector. 4. A local user, process-monito ...[truncated 846 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `--token` command-line option and read the credential directly from the declared environment variable: ```js const token = process.env.JUST_ONE_API_TOKEN; if (!token) { fail("JUST_ONE_API_TOKEN is required."); } ``` 2. Update `SKILL.md` so the command does not expand the secret into an argument: ```bash node {baseDir}/bin/run.mjs --operation "<operation-id>" --params-json '{"key":"value"}' ``` 3. Reject a `token` property supplied through `--params-json`, preventing callers from reintroducing credentials through another serialized command-line argument. 4. Ensure diagnostic output, shell tracing, and execution telemetry never record secret-bearing environment variables. 5. Rotate tokens that may already have appeared in process monitoring, shell traces, or execution logs. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: bin/run.mjs:265
• Finding: API Credential Transmitted in URL Query Parameters<![CDATA[ ## Vulnerability Details **File Location**: `bin/run.mjs:166-178`, `bin/run.mjs:265-275`, and `bin/run.mjs:315-326` **Vulnerability Type**: Sensitive credential placed in a request URL **Risk Level**: Medium ### Vulnerable Code `bin/run.mjs:166-178`: ```js const requestInit = { headers: { "accept": "application/json", }, method: operation.method, }; if (operation.requestBody && params.body !== undefined) { requestInit.body = JSON.stringify(params.body); requestInit.headers["content-type"] = operation.requestBody.contentType || "application/json"; } let response; try { response = await fetch(url, requestInit); ``` `bin/run.mjs:265-275`: ```js function injectToken(operation, params, cliToken) { const tokenParam = operation.parameters.find((parameter) => parameter.name === "token"); if (!tokenParam || params.token !== undefined) { return; } if (!cliToken) { fail("--token is required for this operation.", { operationId: operation.operationId, }); } params.token = cliToken; } ``` `bin/run.mjs:315-326`: ```js function applyQueryParams(operation, params, url) { for (const parameter of operation.parameters.filter((item) => item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } function appendValue(searchParams, name, value) { if (Array.isArray(value)) { ``` The embedded operation definitions classify `token` as a required query parameter. Consequently, `injectToken` places the secret in `params.token`, `applyQueryParams` appends it to `url.searchParams`, and `fetch` transmits a URL containing the credential to `https://api.justoneapi.com`. ### Technical Analysis Although HTTPS protects the request URL while it is in transit, URL query strings commonly pass through or are retained by infrastructure outside the immediate application logic. Potential exposure points in ...[truncated 1811 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. If supported by JustOneAPI, transmit the credential in an authorization header instead of the query string: ```js const requestInit = { headers: { accept: "application/json", authorization: `Bearer ${token}`, }, method: operation.method, }; ``` 2. Remove `token` from the ordinary parameter collection so `applyQueryParams` cannot serialize it into the URL. 3. Reject `params.token` supplied through `--params-json`; credential handling should use one dedicated, controlled path. 4. If the upstream service only supports query-token authentication: - Request or implement header-based authentication at the service level. - Configure clients, proxies, gateways, servers, and observability tools to redact the `token` query parameter. - Avoid logging complete request URLs. - Use narrowly scoped, short-lived tokens where available. - Document the residual query-string exposure risk. 5. Rotate any tokens that may already have been retained in URL, proxy, gateway, tracing, or server logs. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

- Get a token from [Just One API Dashboard](https://dashboard.justoneapi.com/en/login?utm_source=clawhub.ai&utm_medium=referral&utm_campaign=justoneapi_tiktok_shop&utm_content=project_link).
- Authentication details: [Just One API Usage Guide](https://docs.justoneapi.com/en/?utm_source=clawhub.ai&utm_medium=referral&utm_campaign=justoneapi_tiktok_shop&utm_content=project_link).

## Output Rules

- Start with a plain-language answer tied to the TikTok Shop task the user asked for.
- Include the most decision-relevant fields from the selected endpoint before dumping raw JSON.

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill instructs the agent to run a Node helper that performs authenticated external API requests, but the manifest does not declare any explicit tool scope such as permissions or allowed-tools. This creates a governance gap: a reviewer or runtime may not have a clear, enforceable declaration of network capability, making unintended or over-broad external access harder to audit and constrain.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill defines the authentication token as a query parameter and later appends all query parameters directly into the request URL. Tokens in URLs are commonly exposed through logs, browser/history tooling, proxy infrastructure, monitoring systems, crash reports, and upstream services, increasing the chance of credential leakage even when HTTPS is used.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The API authentication token is defined as a query parameter on a GET request, which exposes it in URLs. Query-string secrets are commonly logged by clients, proxies, servers, browser history, observability tooling, and referrer headers, increasing the chance of credential leakage even when TLS is used.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: This operation also requires the authentication token in the query string of a GET request, creating the same exposure path through URL logging and intermediary systems. Because the skill is an API integration layer, users may unknowingly send reusable credentials in places that are broadly captured and retained.

Static analysis

No suspicious patterns detected.