Security audit
Security checks for vulnerabilities and agentic risk
The skill is a narrow JustOneAPI wrapper, but its API token handling can expose the token through command-line arguments and URL query logs.
Review before installing if the JustOneAPI token has meaningful account access or billing impact. Use a narrowly scoped token if possible, avoid shell tracing or logging command lines, do not share full request URLs or errors that may contain query strings, and rotate the token if it may have appeared in logs.
bin/run.mjs:128API Token Exposed Through Process Arguments and URL Query Parameters
The skill invokes a network-capable helper (node .../bin/run.mjs) and relies on an API token, but it does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch weakens policy enforcement and reviewability: an agent platform may permit networked execution without a clear, least-privilege declaration, increasing the chance of unintended external requests or token use.
The skill requires the authentication token to be supplied as a query parameter and then appends it to the request URL. Query-string credentials are commonly exposed in logs, browser/history tooling, reverse proxies, monitoring systems, and error messages, making accidental credential disclosure more likely even when HTTPS is used. In this skill context, the danger is higher because the token is the primary secret for accessing a third-party API and the code provides no warning to users about this handling.
The API specification requires an authentication token to be sent as a URL query parameter, which is a well-known insecure pattern because query strings are commonly logged by servers, proxies, analytics systems, browser history, and monitoring tools. Even if HTTPS is used, the token can still leak through operational logs or shared URLs, enabling unauthorized API access if exposed.
This markdown file describes a token query parameter used for user authentication, which is sensitive credential material. The document does not include any warning about protecting the token, avoiding logging/sharing it, or the privacy implications of sending it in requests.
Detected: suspicious.secret_argv_exposure