ClawHub
Back to skill

Security audit

Xiaohongshu (RedNote) User Published Notes API

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to call the advertised JustOneAPI endpoint, but it handles the API token in a way that can expose it in command lines and URLs.

Install only if you are comfortable giving this skill a JustOneAPI token and understand that the current helper may expose that token through command-line process listings and URL/query logging. Prefer short-lived, scoped tokens if available, rotate tokens after use, and avoid using a token with broader permissions than this endpoint needs.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
bin/run.mjs:120
Finding

API Credential Exposed Through URL Query Parameters and Process Arguments

Content
View full analysis
item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } ``` The operation manifest confirms that the access token is classified as a query parameter: ```js { "defaultValue": null, "description": "Access token for this API service.", "enumValues": [], "location": "query", "name": "token ...[truncated 2579 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bin/run.mjs (reported line 20)May include surrounding context.

js
"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bin/run.mjs (reported line 66)May include surrounding context.

js
"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · generated/operations.json (reported line 15)May include surrounding context.

json
"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · generated/operations.json (reported line 61)May include surrounding context.

json
"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · generated/operations.md (reported line 19)May include surrounding context.

md
"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · generated/operations.md (reported line 43)May include surrounding context.

md
"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill invokes a network-capable helper (node ... run.mjs) and requires an API token, but it does not explicitly declare a tool scope such as permissions or allowed-tools. This creates an authorization/visibility gap where an agent may execute network actions without clear least-privilege boundaries or user/auditor awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill defines the API access token as a query parameter and later appends all query parameters into the URL. Query-string credentials are routinely exposed via logs, browser/history tooling, proxies, monitoring systems, and upstream infrastructure, increasing the chance of token leakage even when HTTPS is used. In this skill context, the risk is elevated because this is a reusable interface skill that normalizes insecure token transport across every invocation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The API requires an access token to be supplied in the URL query string, which is less secure than using an Authorization header. Query parameters are commonly exposed in logs, browser history, intermediary proxies, monitoring systems, and referrer data, increasing the chance of credential leakage even when TLS is used.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The API documentation requires an access token to be sent as a query parameter, which is commonly exposed through browser history, proxy logs, analytics, caches, and server access logs. Even in a documentation-only skill, instructing integrators to place credentials in the URL normalizes an unsafe authentication pattern and increases the chance of token leakage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This second endpoint repeats the same unsafe design by documenting the access token in the query string, creating the same exposure path through logs, monitoring tools, referrers, and cached URLs. Repetition across versions makes the issue more dangerous because consumers are more likely to treat it as the intended long-term authentication model.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

This markdown file falls under the vague-trigger category. The instruction to "pick the operation whose required inputs match the data the user has" is ambiguous because both listed versions require the same input (userId), so it does not clearly constrain when each version should be used. That lack of specificity could lead to inconsistent or unintended invocation behavior.

Content

No source excerpt is available for this finding.