YouTube Video Details API

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:09 AM UTC
• Version: 1.0.0

Overview

The skill appears to do the advertised YouTube lookup, but it handles the JustOneAPI token in a way that can expose it through URLs and process arguments.

Review this before installing if your JustOneAPI token has broad account access, billing impact, or long lifetime. Use a narrowly scoped or disposable token if available, avoid sharing logs or process telemetry from runs, and rotate the token if it may have been exposed. No evidence of malicious behavior or unrelated exfiltration was found.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: bin/run.mjs:196

Finding

API Access Token Exposed Through URL Query String and Process Arguments

Content

View full analysis

item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } ``` The documented invocation also supplies the token through a command-line argument: ```bash node {baseDir}/bin/run.mjs --operation "getYoutubeVideoDetailV1" --token "$JUST_ONE_API_TOKEN" --params-json '{"videoId":""}' ``` ### Technical Analysis The Skill sends requests only to the fixed, declared HTTPS endpoint at `https://api.justoneapi.com`, and transmitting an authentication credential to that service is necessary for the declared functionality. No evidence of covert exfiltration or transmission to an unrelated host was found. However, embedding the access token in the URL is an insecure credential-handling practice. Even when HTTPS protects the URL in transit, complete URLs may be recorded by the destination ...[truncated 1754 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

This finding is substantiated by the manifest explicitly describing an access token parameter located in the query string. In this skill context, the code is a generic API wrapper that propagates the token into outbound requests and may also surface request failures, so credential exposure risk is elevated because tokens can leak into operational logs and third-party observability systems.

Content

Scanner excerpt · bin/run.mjs (reported line 20)May include surrounding context.

js

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The API access token is passed as a query parameter, which is commonly exposed in logs, browser history, proxy records, monitoring tools, and referrer-like telemetry. Even if the endpoint uses HTTPS, placing credentials in the URL increases the chance of accidental disclosure and unauthorized reuse of the token.

Content

Scanner excerpt · generated/operations.json (reported line 15)May include surrounding context.

json

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The API requires an access token in a query parameter, which is dangerous because query strings are commonly logged by clients, proxies, gateways, browser history, and monitoring tools. This increases the chance of credential leakage and subsequent unauthorized use of the external API service.

Content

Scanner excerpt · generated/operations.md (reported line 19)May include surrounding context.

md

| Name | In | Required | Type | Default | Description |
| --- | --- | --- | --- | --- | --- |
| `token` | `query` | yes | `string` | n/a | Access token for this API service. |
| `videoId` | `query` | yes | `string` | n/a | The unique identifier for a YouTube video. |

### Request body

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill invokes a network-capable helper (node .../bin/run.mjs) that sends requests to an external API, but the manifest does not declare any explicit tool scope such as permissions or allowed-tools. This creates a policy gap: a host may permit execution without clearly constraining or surfacing network access, which can lead to unexpected outbound requests and weaker reviewability of the skill's behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill defines the API access token as a query parameter and later appends all query parameters directly into the URL. Query-string credentials are commonly exposed through logs, browser history, proxy infrastructure, monitoring systems, and error messages, making inadvertent token disclosure much more likely even when HTTPS is used.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description does not warn that the skill sends both a video identifier and an API access token to an external service, which can surprise users and operators and weaken informed-consent and data-handling controls. Even though a YouTube video ID is usually low sensitivity, the undisclosed transfer of credentials to a third party increases security and privacy risk in agent workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This manifest-style file describes what the API does, but it does not provide any explicit trigger boundaries, exclusion conditions, or narrow activation guidance. Because SQP-1 applies to manifest files, the broad functional description could contribute to unintended invocation when a user's request loosely relates to YouTube details.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The operation description is overly broad and does not define when the agent should call the external API or what user authorization/trigger is required. In an agent setting, vague invocation scope can lead to unnecessary or unintended transmission of user-supplied video identifiers and service credentials to a third-party endpoint.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical

• Code: suspicious.secret_argv_exposure
• Location: SKILL.md:41