Security audit

抖音文案一键提取

Security checks for vulnerabilities and agentic risk

Overview

The skill coherently transcribes public Douyin videos through SocialDataX, with disclosed credential use and manageable dependency and polling risks.

Use this for explicitly requested public-video transcription. SocialDataX receives the submitted link or ID and uses your service key; processing may consume credits. Prefer a reviewed, pinned CLI version, keep unrelated credentials outside its environment, and set a polling time limit. The supplied static scan reported no findings; advisory dependency and trigger concerns were assessed against the instructions above.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The URL submission command executes socialdatax-skills@latest through npx -y, allowing an unreviewed future package release to run without an installation confirmation. A compromised release could execute code with the agent's permissions and access SOCIALDATAX_API_KEY or other accessible local data; this is a dependency supply-chain risk, not evidence that the current package is malicious.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The aweme-id submission command also executes the mutable @latest package using npx -y. Although the static finding labels it an MCP server reference, the demonstrated path is direct CLI execution, and a compromised package release could access the API key and act with the agent's local permissions.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The job-status command uses the same unpinned @latest execution path, so even a status-only operation depends on whichever package release is resolved at runtime. Repeated polling creates additional execution opportunities, although npx caching means it does not necessarily download a new release on every call; the underlying risk is compromised dependency code accessing credentials or local resources.
Content: No source excerpt is available for this finding.

Generic content-creation and social-media phrases are explicitly mapped to the Douyin transcription workflow.

Medium

Category: Trigger Abuse
Confidence: 94% confidence
Finding: Line 57 includes broad phrases such as “内容创作” (content creation) and “自媒体运营” (social-media operations), then directs that all listed phrases follow this extraction/transcription workflow. These requests do not necessarily involve a Douyin video or transcription, so this mapping can activate the skill for unrelated writing or strategy requests despite the narrower purpose described elsewhere.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.