Xiaohongshu (RedNote) Keyword Suggestions API

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:11 AM UTC
• Version: 1.0.0

Overview

This skill appears to do only the advertised API lookup, but it handles the API token in ways that can expose it through command lines and logged URLs.

Review this skill before installing if your JustOneAPI token has paid quota, broad account access, or long lifetime. Use a dedicated low-privilege token, avoid running it on shared or heavily monitored systems, ensure logs redact `--token` and `token=` query values, and rotate any token that may already have appeared in process or URL logs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: bin/run.mjs:136

Finding

API Token Exposed Through Command-Line Arguments

Content

View full analysis

"}' ``` ### Technical Analysis The helper accepts the JustOneAPI access token through the `--token` command-line option. When the documented shell command is executed, the shell expands `JUST_ONE_API_TOKEN`, placing its value directly in the Node.js process argument vector. Depending on operating-system access controls and deployment configuration, command-line arguments may be visible through process inspection utilities, process metadata interfaces, monitoring agents, crash reports, audit systems, or telemetry collectors. The implementation does not print the token itself, but accepting it through `process.argv` unnecessarily increases the number of local systems that may observe the credential. This behavior exceeds minimum privilege in credential handling because the declared API functionality can instead obtain the required token directly from the already-declared `JUST_ONE_API_TOKEN` environment variable or through protected standard input. ### Attack Path 1. A user follows the command documented in `SKILL.md`. 2. The shell expands `$JUST_ONE_API_TOKEN` into the plaintext token. 3. The token becomes part of the Node.js process argument vector. 4. A local user, privileged process-monitoring service, diagnostic collector, or telemetry system captures the command-line arguments. 5. An attacker or unauthorized operator retrieves the token from the captured process metadata. 6. The token is replayed against JustOneAPI un ...[truncated 645 chars]

Remediation

View remediation

"}' ``` 3. Where stronger isolation is required, accept credentials through protected standard input or an operating-system secret manager. 4. Ensure process monitoring, crash reporting, and telemetry systems redact historical `--token` values. 5. Rotate any token that may already have been captured in process logs or monitoring data. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: bin/run.mjs:20

Finding

API Token Transmitted in the URL Query String

Content

View full analysis

parameter.name === "token"); if (!tokenParam || params.token !== undefined) { return; } if (!cliToken) { fail("--token is required for this operation.", { operationId: operation.operationId, }); } params.token = cliToken; } ``` ```js function applyQueryParams(operation, params, url) { for (const parameter of operation.parameters.filter((item) => item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } function appendValue(searchParams, name, value) { if (Array.isArray(value)) { for (const item of value) { appendValue(searchParams, name, item); } return; } if (value && typeof value === "object") { searchParams.append(name, JSON.stringify(value)); return; } searchParams.append(name, String(value)); } ``` The resulting request has the following effective form: ```text https://api.justoneapi.com/api/xiaohongshu/search-recommend/v1?token=&keyword= ``` ### Technical Analysis The implementation sends the API token as part of the URL query string. HTTPS en ...[truncated 1943 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

This finding reflects credential handling rather than explicit credential theft, but the code does process an access token and sends it in the request URL. In this skill context, that creates a real exposure path for the credential through normal operational logging and third-party infrastructure rather than an intentional credential-access backdoor.

Content

Scanner excerpt · bin/run.mjs (reported line 20)May include surrounding context.

js

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · generated/operations.json (reported line 15)May include surrounding context.

json

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · generated/operations.md (reported line 19)May include surrounding context.

md

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill invokes a network-capable helper (node .../run.mjs) that can make outbound API requests, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates a policy/visibility gap: platforms or reviewers cannot reliably constrain or audit the network behavior from the manifest alone, increasing the chance of unintended external requests or misuse if the skill is modified or repurposed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill defines the API access token as a query parameter and later appends all query parameters to the URL. Secrets in URLs are commonly exposed via logs, browser/history records, proxies, monitoring tools, and upstream infrastructure, making accidental credential disclosure more likely even when HTTPS is used.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Placing an access token in a query parameter is dangerous because query strings are commonly logged by clients, proxies, gateways, browser history, and observability systems. The lack of any user-facing warning or safer authentication guidance increases the chance that credentials are exposed or mishandled during normal use.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

This is a manifest-style JSON file, so vague-trigger review applies. The description explains what the API does but provides no explicit trigger phrases, activation boundaries, or exclusion conditions, which can make invocation conditions ambiguous in systems that derive routing from descriptions.

Content

No source excerpt is available for this finding.