Security audit

Xiaohongshu Creator Marketplace (Pugongying) Creator Search API

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but it handles the JustOneAPI token in a way that can expose the credential in command lines and URL logs.

Review this skill before installing if the token has meaningful quota, billing, or account access. Use a narrowly scoped JustOneAPI token, avoid shell tracing and shared process-monitoring environments, rotate the token if command lines or request URLs may have been logged, and prefer a version that supports header-based authentication.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: bin/run.mjs:27
Finding: API Credential Exposed Through Command-Line Arguments and URL Query Parameters
Content: View full analysis
parameter.name === "token"); if (!tokenParam || params.token !== undefined) { return; } if (!cliToken) { fail("--token is required for this operation.", { operationId: operation.operationId, }); } params.token = cliToken; } ``` All query parameters, including the token, are serialized into the request URL: ```js function applyQueryParams(operation, params, url) { for (const parameter of operation.parameters.filter((item) => item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchPar ...[truncated 3579 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill invokes a network-capable helper (node {baseDir}/bin/run.mjs calling a remote API) but does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization gap where an agent or runtime may allow broader outbound actions than intended, reducing transparency and policy enforcement for network access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill requires the authentication token to be supplied and then sends it as a query parameter on a GET request. Query-string tokens are commonly exposed through logs, browser/history layers, proxy/CDN telemetry, monitoring systems, and error traces, making credential leakage more likely than if the token were sent in an Authorization header or request body over HTTPS.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation requires a user authentication token as a query parameter but does not warn that credentials in URLs are highly sensitive. Query parameters are commonly exposed in logs, browser history, analytics, referrers, and intermediary infrastructure, which increases the chance of credential leakage and unauthorized API access.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical

Code: suspicious.secret_argv_exposure
Location: SKILL.md:53