Weibo Post Comments API

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:53 AM UTC
• Version: 1.0.0

Overview

The skill does what it claims, but it handles the API token in ways that can expose the credential through process arguments and URL query strings.

Review this skill before installing if the JustOneAPI token is sensitive or tied to billing. Prefer a version that reads the token from a safer secret channel and sends it via an authorization header if the provider supports that; otherwise use a narrowly scoped, revocable token and avoid logging full command lines or request URLs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: bin/run.mjs:22

Finding

API Token Exposed Through Process Arguments and URL Query Parameters

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bin/run.mjs (reported line 20)May include surrounding context.

js

"parameters": [
        {
          "defaultValue": null,
          "description": "API access token.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · generated/operations.json (reported line 15)May include surrounding context.

json

"parameters": [
        {
          "defaultValue": null,
          "description": "API access token.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · generated/operations.md (reported line 19)May include surrounding context.

md

"parameters": [
        {
          "defaultValue": null,
          "description": "API access token.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill invokes a network-capable helper (node {baseDir}/bin/run.mjs) and is designed to call an external API, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates a governance and least-privilege gap: an agent runtime or reviewer cannot easily restrict or reason about the network access the skill requires, increasing the risk of unintended outbound requests or overbroad execution in permissive environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill sends the API access token as a URL query parameter, which is commonly exposed in logs, browser history, reverse proxies, analytics tooling, and error messages. Although the request uses HTTPS, query-string secrets are still more broadly propagated than header-based credentials, increasing the chance of accidental credential disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest requires an API access token to be sent as a query parameter, but provides no warning about credential exposure or handling. Query-string tokens are commonly logged by clients, proxies, browser histories, and monitoring systems, which increases the risk of accidental credential disclosure.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

This JSON manifest describes the skill in general terms as calling a Weibo comments endpoint, but it does not provide any explicit trigger phrases, scope limitations, or negative examples to clarify when the skill should or should not be invoked. For manifest files, this can create overly broad matching against generic requests about Weibo comments.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical

• Code: suspicious.secret_argv_exposure
• Location: SKILL.md:44