ClawHub
Back to skill

Security audit

抖音账号诊断

Security checks for vulnerabilities and agentic risk

Overview

The skill provides a clearly scoped, read-only analysis of public Douyin accounts through SocialDataX, with ordinary third-party service and software-update considerations.

Use this only if you trust SocialDataX with the account lookup input and accept its API charges. Supply just the profile link or identifier, excluding unrelated private text. Prefer a reviewed, pinned package version over @latest. The read-only boundary describes the intended account operations; it does not sandbox downloaded software.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

The workflow sends user-provided account identifiers or share text to SocialDataX without an explicit privacy disclosure.

Medium
Category
Output Handling
Confidence
92% confidence
Finding

The skill instructs the agent to execute API-backed commands containing the user's profile URL or share text, with additional commands accepting sec_user_id. Although it identifies SocialDataX and describes the skill as read-only, it never clearly warns that these user-provided inputs are transmitted to an external service; read-only access does not eliminate that privacy impact.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

The command executes socialdatax-skills@latest through npx with automatic confirmation, allowing the code executed to change without review. A compromised package release could execute with the agent's permissions and access SOCIALDATAX_API_KEY or other accessible local data; the skill's read-only description does not constrain package execution. This is a CLI supply-chain issue, not specifically an MCP-server issue.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

This user-posts command also executes the mutable @latest package through npx without interactive confirmation. If a future release is compromised, its code can run with the agent's privileges and access available credentials regardless of the intended read-only API operation. It repeats the same supply-chain weakness as the preceding command.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

The sec-user-id variant still runs socialdatax-skills@latest, so choosing a different account identifier does not mitigate the mutable dependency. A malicious or compromised release could execute arbitrary code under the agent's account and expose its API key. This is another occurrence of the same underlying supply-chain vulnerability.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

This command repeats automatic execution of the unpinned @latest package for retrieving account posts. The sample and time limits constrain intended API results, not what the downloaded executable can do, so a compromised release could access credentials or modify accessible files. The four RP1 findings represent one repeated supply-chain weakness rather than four independent attack mechanisms.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.