Security audit

Web Page Rendered HTML Content API

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it handles the JustOneAPI token in a way that can expose it through process arguments and URL logs.

Install only if you trust JustOneAPI with the target URLs you submit and with your API token. Use a revocable, narrowly scoped token if available, avoid URLs containing secrets or private session data, and rotate the token if command arguments or request URLs may be logged in your environment.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: bin/run.mjs:220
Finding: API Token Exposed Through URL Query Parameters and Process Arguments
Content: View full analysis
item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } ``` The documented invocation also supplies the secret through a command-line argument: ```bash node {baseDir}/bin/run.mjs --operation "renderedHtmlV1" --token "$JUST_ONE_API_TOKEN" --params-json '{"url":""}' ``` ### Technical Analysis The authentication token is added to the final request URL as `token=`. Although HTTPS encrypts the URL while it is in transit, query strings can still be recorded by the API server, reverse proxies, gateways, network-observability products, debugging tools, and error-monitoring systems. Systems that ...[truncated 2610 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill invokes a network-capable helper (node ... run.mjs) against an external API and accepts a user-supplied url, but it does not declare any explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and makes the network behavior implicit, increasing the risk of unintended outbound requests, policy bypass, or misuse such as fetching attacker-chosen targets through the backend service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill requires the API token as a query parameter and automatically injects it into the request URL. Query-string secrets are commonly exposed through logs, browser/proxy history, monitoring systems, and upstream infrastructure, making credential disclosure more likely even when HTTPS is used. In this skill's context, the risk is not mitigated by necessity shown in the code, and the token protects access to an external API service.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This manifest-style JSON describes what the skill does, but it does not define any specific activation phrases, constraints, or exclusion conditions. For manifest files, the absence of trigger specificity can make it unclear when the skill should activate versus when similar web-related requests should not invoke it.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 72% confidence
Finding: All natural-language descriptions in the manifest are presented only in English, and there is no indication that users can opt into another language or locale. If organizational policy requires language choice rather than a fixed language default, this may be a policy issue.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The operation documentation accepts a user-supplied URL and an authentication token, but it does not warn users that invoking the skill causes outbound network access to an arbitrary destination or that the token is sensitive. In an agent context, this can lead to unintended requests to attacker-controlled URLs and accidental disclosure or mishandling of credentials, even though the issue is primarily documentation/safety guidance rather than direct code execution.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical

Code: suspicious.secret_argv_exposure
Location: SKILL.md:41