Security audit

抖音内容研究

Security checks for vulnerabilities and agentic risk

Overview

The skill coherently supports read-only Douyin research through SocialDataX, with ordinary third-party service and package-installation risks.

Use search terms you are comfortable sharing with SocialDataX and keep the API key out of chat and version control. Prefer a reviewed, fixed package version and restrict its access to unrelated files and credentials. Searches may consume paid credits. This review covers the bundled instructions; the external npm package and hosted service remain outside the inspected artifacts.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The hot-search command uses npx -y socialdatax-skills@latest, automatically executing a mutable npm release rather than a reviewed, fixed version. A compromised publisher account or malicious release could execute code with the agent process's permissions and access its API key and accessible files; the skill's read-only claim does not constrain package execution. Although the finding labels this an MCP server, the actual example is a direct CLI invocation with the same supply-chain exposure.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The search example independently invokes npx -y socialdatax-skills@latest, allowing newly published code to execute without version review or an installation confirmation. If the package supply chain is compromised, that code could steal the API credential, read accessible local data, or modify files despite the intended read-only search workflow. This is another occurrence of the same underlying dependency-pinning weakness, not evidence of a separate malicious component.
Content: No source excerpt is available for this finding.

The search workflow sends user-derived keywords to a third-party service without an explicit privacy disclosure.

Medium

Category: Output Handling
Confidence: 92% confidence
Finding: The skill instructs the agent to call douyin_search_videos with a keyword derived from the user's actual intent; the direct CLI workflow likewise submits search keywords. Although SocialDataX and its authentication requirements are documented, the skill does not warn that user-derived search terms are transmitted to that third-party service and may expose confidential research interests.
Content: No source excerpt is available for this finding.