Security audit

社媒数据助手抖音 MCP | Douyin MCP

Security checks for vulnerabilities and agentic risk

Overview

This plugin coherently provides read-only Douyin research tools through a disclosed hosted SocialDataX endpoint.

Install only if you are comfortable sending Douyin search terms, profile/content URLs, and your SocialDataX API key to the hosted SocialDataX MCP service. The reviewed artifacts show read-only lookup behavior and no local persistence or account actions.

SkillSpector

SkillSpector was not run because this plugin release contains no bundled skills.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: README.md:46
Evidence: export SOCIALDATAX_API_KEY="[REDACTED]"