Douyin Creator Marketplace (Xingtu) Recommended Videos API

Call GET /api/douyin-xingtu/gw/api/data_sp/author_rec_videos_v2/v1 for Douyin Creator Marketplace (Xingtu) Recommended Videos through JustOneAPI with oAuthorId.

Security Scan

The skill's code, instructions, and required environment variable (JUST_ONE_API_TOKEN) are consistent with its stated purpose (calling a JustOneAPI Douyin/Xingtu recommended-videos endpoint); no unrelated credentials, unexpected network endpoints, or install steps are present — but note the token is sent as a query parameter/CLI argument which can increase exposure risk.

Purpose & Capability

Name/description match the implementation: the packaged run.mjs calls https://api.justoneapi.com and implements the documented GET /api/douyin-xingtu/.../author_rec_videos_v2/v1 endpoint. The only required binary is node and the only required environment variable is JUST_ONE_API_TOKEN, which is appropriate for a third-party API wrapper.

Instruction Scope

SKILL.md and bin/run.mjs instruct the agent to collect a single required parameter (oAuthorId) and to pass the token via --token. The instructions are narrowly scoped to making the API request and returning JSON. One operational note: the implementation places the token in the request query string and accepts it via a CLI flag; this can increase exposure risk (see environment_proportionality). The skill does not read local files or other env vars.

Install Mechanism

There is no install spec (instruction-only style with bundled run.mjs). Nothing is downloaded or written during install. This is a low-risk delivery model.

Credentials

The single required credential (JUST_ONE_API_TOKEN) is proportional to the skill's purpose. However, the runtime injects the token as a query parameter ('token') and accepts it via a CLI argument (--token), which can expose the secret to process listings, shell history, or URL logs (server logs, proxies). SKILL.md warns not to paste tokens into chat but does not explicitly warn about CLI/process or URL exposure.

Persistence & Privilege

The skill does not request persistent presence (always:false) and does not modify agent/system configuration. It only executes a single network request at runtime and prints JSON to stdout.

Assessment

This skill appears to do exactly what it claims: call a JustOneAPI Douyin/Xingtu endpoint and return JSON. Before installing or running it, consider the following: (1) Protect your JUST_ONE_API_TOKEN — the script sends it as a query parameter and accepts it as a CLI argument, both of which can expose the token in process listings, shell history, or server/proxy logs. Avoid pasting the token into chat or public logs, use short-lived or scoped tokens where possible, and rotate the token periodically. (2) Run the script only on trusted machines; if you need stricter secrecy, inspect and modify run.mjs to read the token from a protected source (e.g., process.env inside a securely launched process) rather than passing it directly on the command line. (3) Review JustOneAPI's dashboard/permissions and token scope to limit blast radius. Other than the token-exposure caveat, the skill is internally coherent and focused on its stated purpose.

Douyin Creator Marketplace (Xingtu) Recommended Videos

Use this focused JustOneAPI skill for recommended Videos in Douyin Creator Marketplace (Xingtu). It targets GET /api/douyin-xingtu/gw/api/data_sp/author_rec_videos_v2/v1. Required non-token inputs are oAuthorId. OpenAPI describes it as: Get Douyin Creator Marketplace (Xingtu) recommended Videos data, including content references used, for creator evaluation.

Endpoint Scope

• Platform key: douyin-xingtu
• Endpoint key: gw/api/data_sp/author_rec_videos_v2
• Platform family: Douyin Creator Marketplace (Xingtu)
• Skill slug: justoneapi-douyin-xingtu-gw-api-data-sp-author-rec-videos-v2

Operation	Version	Method	Path	OpenAPI summary
gwApiDataSpAuthorRecVideosV2V1	v1	GET	/api/douyin-xingtu/gw/api/data_sp/author_rec_videos_v2/v1	Recommended Videos

Inputs

Parameter	In	Required by	Optional by	Type	Notes
oAuthorId	query	all	n/a	string	Author's unique ID
platform	query	n/a	all	string	Platform type. Available Values: - SHORT_VIDEO: Short video - LIVE_STREAMING: Live streaming - PICTURE_TEXT: Picture and text - SHORT_DRAMA: Short drama
platform enum	values	n/a	n/a	n/a	LIVE_STREAMING, PICTURE_TEXT, SHORT_DRAMA, SHORT_VIDEO

Request body: none documented; send parameters through path or query arguments.

Version Choice

Use gwApiDataSpAuthorRecVideosV2V1 for the documented v1 endpoint. There are no alternate versions grouped in this skill.

Run This Endpoint

Supported operation IDs in this skill: gwApiDataSpAuthorRecVideosV2V1.

node {baseDir}/bin/run.mjs --operation "gwApiDataSpAuthorRecVideosV2V1" --token "$JUST_ONE_API_TOKEN" --params-json '{"oAuthorId":"<oAuthorId>"}'

Ask for any missing required parameter before calling the helper. Keep user-provided IDs, cursors, keywords, and filters unchanged.

Environment

• Required: JUST_ONE_API_TOKEN
• Pass the token with --token "$JUST_ONE_API_TOKEN"; do not paste token values into chat messages, screenshots, or logs.
• Get a token from Just One API Dashboard.
• Authentication details: Just One API Usage Guide.

Output Focus

• State the operation ID and endpoint path used, for example gwApiDataSpAuthorRecVideosV2V1 on /api/douyin-xingtu/gw/api/data_sp/author_rec_videos_v2/v1.
• Echo the required lookup scope (oAuthorId) before summarizing results.
• Prioritize fields that support this endpoint purpose: Get Douyin Creator Marketplace (Xingtu) recommended Videos data, including content references used, for creator evaluation.
• Return raw JSON only after the short, endpoint-specific summary.
• If the backend errors, include the backend payload and the exact operation ID.