Security audit

YOUKU API

Security checks for vulnerabilities and agentic risk

Overview

The skill is a straightforward YOUKU API wrapper, but users should be careful because its API token is passed through command-line arguments and URL query parameters.

Install only if you trust JustOneAPI with your YOUKU API requests and token. Prefer running it in an environment where process arguments and request URLs are not broadly logged, and rotate the token if you suspect it has appeared in logs or diagnostics.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:42
Finding: API Token Exposed Through Command-Line Arguments
Content: View full analysis
" --token "$JUST_ONE_API_TOKEN" --params-json '{"key":"value"}' ``` ```javascript function injectToken(operation, params, cliToken) { const tokenParam = operation.parameters.find((parameter) => parameter.name === "token"); if (!tokenParam || params.token !== undefined) { return; } if (!cliToken) { fail("--token is required for this operation.", { operationId: operation.operationId, }); } params.token = cliToken; } ``` ### Technical Analysis The documented invocation expands `JUST_ONE_API_TOKEN` into the `--token` command-line argument. Although shell expansion does not normally place the expanded value in shell history when the literal command uses an environment variable, the resulting Node.js process receives the actual credential in its argument vector. Depending on the operating system, container configuration, process permissions, and diagnostic tooling, command-line arguments can be visible through process inspection interfaces, monitoring agents, crash diagnostics, audit logs, or process-list utilities. This creates an avoidable credential-disclosure channel. The executable also permits `token` to be supplied inside `--params-json`. Because `injectToken` returns when `params.token` is already defined, callers can bypass the intended `--token` path and place credentials in another command-line argument. Both supported input methods therefore expose the credential through the process argument vector. ### Attack Path 1. A user follows the documented command and invokes the helper with `--token "$JUST_ONE_API_TOKEN"`. 2. The shell expands the environment variable before starting Node.js. 3. The complete token becomes part of the helper process's ar ...[truncated 947 chars]
Remediation: View remediation
" --params-json '{"key":"value"}' ``` 3. Reject `token` when it appears in `--params-json` so callers cannot reintroduce command-line disclosure: ```javascript if (Object.prototype.hasOwnProperty.call(params, "token")) { fail("Do not provide token through --params-json."); } ``` 4. Avoid printing credentials or complete authenticated request URLs in errors, debug output, telemetry, or crash reports. 5. Rotate any token that may already have been exposed through process monitoring or diagnostic collection. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: bin/run.mjs:328
Finding: API Token Transmitted as a URL Query Parameter
Content: View full analysis
parameter.name === "token"); if (!tokenParam || params.token !== undefined) { return; } if (!cliToken) { fail("--token is required for this operation.", { operationId: operation.operationId, }); } params.token = cliToken; } ``` ```javascript function applyQueryParams(operation, params, url) { for (const parameter of operation.parameters.filter((item) => item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } ``` ```javascript function appendValue(searchParams, name, value) { if (Array.isArray(value)) { for (const item of value) { appendValue(searchParams, name, item); } return; } if (value && typeof value === "object") { searchParams.append(name, JSON.stringify(value)); return; } searchParams.append(name, String(value)); } ``` The resulting URL is transmitted here: ```javascript let response; try { response = await fetch(url, requestInit); } catch (error) { fail("Network request failed.", { cause: error instanceof Error ? error.message : String(error), operationId: operation.operationId, }); } ``` ### Technical Analysis Every operation declares the required `token` parameter with `location: "query"`. The helper injects the credential into `params.token`, and `applyQueryParams` appends all query parameters to the request URL without special handling for secrets. Requests therefore take the ...[truncated 2242 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.
md
- Get a token from [Just One API Dashboard](https://dashboard.justoneapi.com/en/login?utm_source=clawhub.ai&utm_medium=referral&utm_campaign=justoneapi_youku&utm_content=project_link). - Authentication details: [Just One API Usage Guide](https://docs.justoneapi.com/en/?utm_source=clawhub.ai&utm_medium=referral&utm_campaign=justoneapi_youku&utm_content=project_link). ## Output Rules - Start with a plain-language answer tied to the YOUKU task the user asked for. - Include the most decision-relevant fields from the selected endpoint before dumping raw JSON.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill explicitly instructs the agent to execute a Node helper that performs authenticated external API requests, but the manifest does not declare any tool scope such as allowed network/tool permissions. That mismatch weakens policy enforcement and reviewability because a consumer cannot tell from the skill declaration that it will invoke code with network access and a secret token.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This skill sends the API token in the URL query string, which is commonly logged by client tooling, proxies, gateways, browser/history layers, observability systems, and server access logs. Even though the destination uses HTTPS, query parameters are still broadly exposed to secondary systems, making credential leakage more likely than if the token were placed in an Authorization header or request body where appropriate.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The API token is defined as a required query parameter, which causes credentials to be placed in URLs. Query parameters are commonly logged by browsers, proxies, servers, monitoring tools, and analytics systems, increasing the chance of accidental credential exposure and replay by anyone who obtains those logs.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This operation also requires the token in the query string, exposing sensitive credentials in request URLs rather than protected headers. Even over HTTPS, URLs may still be retained in access logs, error traces, browser history, and third-party observability tooling, making token leakage more likely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The search endpoint repeats the same insecure pattern of passing the sensitive token as a query parameter. Because this is likely to be used frequently and potentially with user-supplied searches, the volume of requests can amplify exposure through URL logging and shared infrastructure, increasing the chance of credential compromise.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file documents operations that require a token query parameter, which is a credential-like value, but it does not warn users that the token will be sent to an external API or advise on secure handling. Under the markdown-file criteria for missing user warnings, omission of privacy or credential-handling warnings is a relevant safety gap.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.