ClawHub
Back to skill

Security audit

抖音选题分析

Security checks for vulnerabilities and agentic risk

Overview

The skill coherently supports read-only Douyin research through SocialDataX, with disclosed authentication and ordinary third-party package risks.

Review and preferably pin the npm package version before execution; its implementation was not bundled for inspection. Searches send your chosen terms to SocialDataX and may consume paid credits, so avoid confidential queries unless intended. Store the API key in the client's secret facility and keep any local credential file out of version control.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

The command executes socialdatax-skills@latest through npx -y, automatically trusting whichever package release is current. A compromised release could execute with the agent's filesystem permissions and access its API key or other inherited credentials; the skill's read-only business operations do not restrict package execution. Although the finding calls this an MCP server reference, the actual exposure is the direct CLI's unpinned executable dependency.

Content

No source excerpt is available for this finding.

The workflow sends user-derived search terms to SocialDataX without an explicit privacy disclosure.

Medium
Category
Output Handling
Confidence
91% confidence
Finding

The skill instructs the agent to execute a SocialDataX search using keywords derived from the user's actual intent. Although it explains API authentication and describes the skill as read-only, it never warns that those keywords are transmitted to a third-party service and could contain sensitive research topics or business information.

Content

No source excerpt is available for this finding.