Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent read-only Douyin product comparison helper, but it runs an unpinned npm package at invocation time, so the executable code can change after review.
Review this before installing if you require reproducible or tightly controlled execution. The skill appears read-only and scoped to Douyin product details, but it should ideally pin `socialdatax-skills` to a reviewed exact version and run only in an environment where exposing `SOCIALDATAX_API_KEY` to that CLI is acceptable.
The skill instructs agents to execute npx -y socialdatax-skills@latest ..., which fetches and runs whatever code is currently published under that package at execution time. Because the version is not pinned and uses @latest, a compromised publisher account, malicious update, or supply-chain takeover could cause arbitrary code execution in the agent environment.
This command also uses npx -y socialdatax-skills@latest, creating the same unpinned remote-code-execution risk each time the skill is invoked. In agent environments, this is especially dangerous because the fetched package executes with the agent's local permissions and may access environment variables such as SOCIALDATAX_API_KEY.
No suspicious patterns detected.
