Security audit

TikTok Shop API

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its TikTok Shop API purpose, but it handles the JustOneAPI token in command arguments and URL query strings where it may be captured in logs or process metadata.

Review before installing. Use only a narrowly scoped JustOneAPI token, avoid shell tracing or logging command invocations, and rotate the token if it may have appeared in process logs or full request URLs. The skill does not show hidden exfiltration or persistence, but its credential handling is weaker than expected for a reusable API integration.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: bin/run.mjs:219
Finding: API Credential Exposed Through Command-Line Arguments
Content: View full analysis
" --token "$JUST_ONE_API_TOKEN" --params-json '{"key":"value"}' ``` `bin/run.mjs:219-235`: ```js function parseArgs(argv) { const parsed = { operation: null, paramsJson: "{}", token: null }; for (let index = 0; index < argv.length; index += 1) { const flag = argv[index]; const value = argv[index + 1]; if (flag === "--operation") { parsed.operation = value; index += 1; continue; } if (flag === "--params-json") { parsed.paramsJson = value; index += 1; continue; } if (flag === "--token") { parsed.token = value; index += 1; continue; ``` ### Technical Analysis The documented invocation passes `JUST_ONE_API_TOKEN` as the value of the `--token` command-line argument. The helper then reads the credential directly from `process.argv`. Command-line arguments can be exposed through operating-system process inspection, process-monitoring software, execution telemetry, shell debugging, wrapper scripts, and improperly configured job systems. Expanding the environment variable in the shell does not protect it after expansion: the resulting secret becomes part of the Node.js process argument vector. Authentication is necessary for the Skill's declared TikTok Shop API functionality, but placing the credential in the argument vector creates avoidable exposure and is not a least-exposure credential-handling design. ### Attack Path 1. A user follows the documented command and invokes the helper with `--token "$JUST_ONE_API_TOKEN"`. 2. The shell expands the environment variable into the actual credential. 3. The credential becomes part of the Node.js process argument vector. 4. A local user, process-monito ...[truncated 846 chars]
Remediation: View remediation
" --params-json '{"key":"value"}' ``` 3. Reject a `token` property supplied through `--params-json`, preventing callers from reintroducing credentials through another serialized command-line argument. 4. Ensure diagnostic output, shell tracing, and execution telemetry never record secret-bearing environment variables. 5. Rotate tokens that may already have appeared in process monitoring, shell traces, or execution logs. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: bin/run.mjs:265
Finding: API Credential Transmitted in URL Query Parameters
Content: View full analysis
parameter.name === "token"); if (!tokenParam || params.token !== undefined) { return; } if (!cliToken) { fail("--token is required for this operation.", { operationId: operation.operationId, }); } params.token = cliToken; } ``` `bin/run.mjs:315-326`: ```js function applyQueryParams(operation, params, url) { for (const parameter of operation.parameters.filter((item) => item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } function appendValue(searchParams, name, value) { if (Array.isArray(value)) { ``` The embedded operation definitions classify `token` as a required query parameter. Consequently, `injectToken` places the secret in `params.token`, `applyQueryParams` appends it to `url.searchParams`, and `fetch` transmits a URL containing the credential to `https://api.justoneapi.com`. ### Technical Analysis Although HTTPS protects the request URL while it is in transit, URL query strings commonly pass through or are retained by infrastructure outside the immediate application logic. Potential exposure points in ...[truncated 1811 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.
md
- Get a token from [Just One API Dashboard](https://dashboard.justoneapi.com/en/login?utm_source=clawhub.ai&utm_medium=referral&utm_campaign=justoneapi_tiktok_shop&utm_content=project_link). - Authentication details: [Just One API Usage Guide](https://docs.justoneapi.com/en/?utm_source=clawhub.ai&utm_medium=referral&utm_campaign=justoneapi_tiktok_shop&utm_content=project_link). ## Output Rules - Start with a plain-language answer tied to the TikTok Shop task the user asked for. - Include the most decision-relevant fields from the selected endpoint before dumping raw JSON.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill instructs the agent to run a Node helper that performs authenticated external API requests, but the manifest does not declare any explicit tool scope such as permissions or allowed-tools. This creates a governance gap: a reviewer or runtime may not have a clear, enforceable declaration of network capability, making unintended or over-broad external access harder to audit and constrain.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill defines the authentication token as a query parameter and later appends all query parameters directly into the request URL. Tokens in URLs are commonly exposed through logs, browser/history tooling, proxy infrastructure, monitoring systems, crash reports, and upstream services, increasing the chance of credential leakage even when HTTPS is used.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The API authentication token is defined as a query parameter on a GET request, which exposes it in URLs. Query-string secrets are commonly logged by clients, proxies, servers, browser history, observability tooling, and referrer headers, increasing the chance of credential leakage even when TLS is used.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This operation also requires the authentication token in the query string of a GET request, creating the same exposure path through URL logging and intermediary systems. Because the skill is an API integration layer, users may unknowingly send reusable credentials in places that are broadly captured and retained.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.