ClawHub
Back to skill

Security audit

直播带货话术

Security checks for vulnerabilities and agentic risk

Overview

The skill’s sales-script drafting and optional product lookups fit its purpose, with ordinary software-download and API-key precautions.

You can draft from supplied product information without configuring credentials. Online lookups use SocialDataX credentials and may consume paid credits. Prefer a reviewed, pinned CLI version and client-managed secret storage. The submitted instructions were fully reviewed; externally downloaded npm code remains outside this inspection.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium
Category
MCP Rug Pull
Confidence
99% confidence
Finding

The command uses socialdatax-skills@latest, which is a mutable tag rather than a pinned version; although labeled as an MCP reference, this is a direct CLI execution risk. A compromised or malicious future release could execute with the agent's permissions and access its API key or other accessible data, regardless of the intended read-only product lookup.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium
Category
MCP Rug Pull
Confidence
99% confidence
Finding

This URL-based product lookup also executes socialdatax-skills@latest through npx with automatic confirmation, allowing the code executed to change without review. If the package or its release pipeline is compromised, the resulting code could steal the injected API key or modify accessible files; the read-only business operation does not constrain the executable.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium
Category
MCP Rug Pull
Confidence
99% confidence
Finding

The SKU lookup runs an unpinned npm package using the mutable @latest tag, creating a supply-chain code-execution exposure rather than an MCP-specific issue. A malicious release would run in the same environment that is deliberately configured with credentials, increasing the potential impact beyond incorrect product data.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium
Category
MCP Rug Pull
Confidence
99% confidence
Finding

This command repeats the same mutable-version execution pattern for the Xiaohongshu URL lookup. Although the skill limits intended actions to reading product details, those instructions cannot prevent a compromised npm release from executing arbitrary code with the agent's available permissions and secrets.

Content

No source excerpt is available for this finding.