Security audit

Zhihu Answer List API

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims, but it handles the JustOneAPI token in exposed places that users should review before installing.

Install only if you are comfortable with your JustOneAPI token being passed to api.justoneapi.com as a query parameter and supplied to the helper as a command-line argument. Prefer a low-scope, revocable token, avoid shell tracing and shared logs, and rotate the token if it may have appeared in process listings, command history, traces, or URL logs.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: bin/run.mjs:100
Finding: API Credential Exposed Through Command-Line Arguments and URL Query Parameters
Content: View full analysis
"}' ``` `bin/run.mjs:22-29` declares the token as a query parameter: ```js { "defaultValue": null, "description": "TOKEN", "enumValues": [], "location": "query", "name": "token", "required": true, "schemaType": "string" }, ``` `bin/run.mjs:100-111` injects the token into the parameters and constructs the request URL: ```js const params = parseParams(args.paramsJson); applyDefaults(operation, params); injectToken(operation, params, args.token); validateRequired(operation, params); const baseUrl = manifest.baseUrl; const url = new URL(operation.path, ensureBaseUrl(baseUrl)); applyPathParams(operation, params, url); applyQueryParams(operation, params, url); const requestInit = { headers: { "accept": "application/json", }, method: operation.method, }; ``` `bin/run.mjs:242-250` serializes every query parameter, including `token`, into the URL: ```js function applyQueryParams(operation, params, url) { for (const parameter of operation.parameters.filter((item) => item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } ``` ### Technical Analysis Authentication is necessary for the declared JustOneAPI functionality, and the credential is sent only to the fixed, documented HTTPS destination `https://api.justoneapi.com`. The audit found no evidence that the token is deliberately sent to an unrelate ...[truncated 2471 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill requires a sensitive token and sends it as a URL query parameter to a third-party API. Query parameters are commonly exposed in logs, browser/history equivalents, proxies, observability systems, and upstream infrastructure, which increases the chance of credential leakage beyond the immediate request. In this skill context, the token is the primary secret for accessing the external service, so placing it in the URL is riskier than sending it in an authorization header.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill requires a sensitive API token to be supplied as a URL query parameter, which is unsafe because query strings are commonly captured in browser history, intermediary logs, analytics systems, reverse proxies, and server access logs. Although the request uses HTTPS, placing credentials in the URL increases accidental disclosure risk and there is no warning that the token is being sent to a third-party service (JustOneAPI).
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The operation requires a token query parameter but the documentation provides no warning about secure credential handling, logging exposure, or privacy implications. Putting tokens in URL query strings is risky because URLs are commonly stored in browser history, proxy logs, server logs, analytics systems, and monitoring tools, which can lead to credential disclosure and unauthorized API access.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical

Code: suspicious.secret_argv_exposure
Location: SKILL.md:46