Security audit

Xiaohongshu Creator Marketplace (Pugongying) Note Details API

Security checks for vulnerabilities and agentic risk

Overview

This is a focused read-only API wrapper, but it handles the API token in ways that can expose it through process arguments and URL query logging.

Review before installing if your JustOneAPI token has broad account access, billing impact, or long lifetime. Use a narrowly scoped token if available, avoid running the command where process arguments are logged, and rotate the token if it may have appeared in shell, job, proxy, gateway, or API logs.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: bin/run.mjs:23
Finding: API Token Exposure Through Command-Line Arguments and URL Query Parameters
Content: View full analysis
parameter.name === "token"); if (!tokenParam || params.token !== undefined) { return; } if (!cliToken) { fail("--token is required for this operation.", { operationId: operation.operationId, }); } params.token = cliToken; } ``` All parameters declared with `location === "query"`, including the token, are appended to the request URL: ```javascript function applyQueryParams(operation, params, url) { for (const parameter of operation.parameters.filter((item) => item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } function appendValue(searchParams, name, value) { if (Array.isArray(value)) { for (const item of value) { appendValue(searchParams, name, item); } return; } if (value && typeof value === "object") { searchParams.append(name, JSON.stringify(value)); return; } searchParams.append(name, String(value)); } ``` The documented invocation explicitly places the token in the process argument list: ` ...[truncated 3217 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill invokes a network-capable helper (node .../bin/run.mjs) and is explicitly designed to call an external API, but it does not declare a tool scope such as permissions or allowed-tools. This creates an authorization gap: platforms or reviewers cannot clearly constrain or reason about the skill's external communication behavior, increasing the risk of unintended outbound requests or misuse in environments that rely on declarative tool restrictions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The operation documentation requires a user authentication token in a query parameter but provides no warning about secure handling, storage, logging, or privacy implications. Query parameters are especially sensitive because they are commonly captured in logs, browser history, proxies, and analytics systems, which can expose credentials and enable unauthorized API access.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The operation description and display name are hard-coded to the Xiaohongshu Creator Marketplace context, which is a specific Chinese platform/locale, but the file does not indicate user opt-in or a documented justification for this locale constraint. Under the stated policy, locale-specific behavior should either offer choice or clearly document why the restriction is required.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical

Code: suspicious.secret_argv_exposure
Location: SKILL.md:41