ClawHub
Back to skill

Security audit

抖音趋势洞察

Security checks for vulnerabilities and agentic risk

Overview

The skill fits its trend-research purpose, while requiring trust in SocialDataX and an external software package.

Search terms and filters go to SocialDataX, so avoid confidential query content and check service charges. Prefer a reviewed, fixed CLI version with limited permissions. Keep the API key in supported secret storage. The bundled instructions were fully inspected, but the external CLI's implementation remains outside this review.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

The hot-search command uses npx -y socialdatax-skills@latest, automatically executing a mutable package release rather than a reviewed, fixed version. A compromised package release could execute with the agent process's permissions and access its API key and other accessible resources; the skill's read-only claim does not constrain package execution. This is a direct CLI supply-chain risk, not specifically an MCP-server configuration issue.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

The search command also runs socialdatax-skills@latest through npx -y, allowing an unreviewed future release to execute automatically. If the package or its release pipeline is compromised, the code could steal credentials or modify resources accessible to the agent, regardless of the intended read-only search operation. This duplicates the preceding supply-chain weakness in a second command.

Content

No source excerpt is available for this finding.

The search workflow sends user-derived keywords to SocialDataX without an explicit privacy disclosure.

Medium
Category
Output Handling
Confidence
90% confidence
Finding

The skill instructs the agent to submit searches using keywords derived from the user's actual intent (line 54), but does not warn that those terms are transmitted to the third-party SocialDataX service. The read-only assurances in the safety section address account modifications and local browser access, not disclosure of potentially sensitive research topics or business plans.

Content

No source excerpt is available for this finding.