Security audit

SocialDataX 内容日历研究

Security checks for vulnerabilities and agentic risk

Overview

The skill fits its stated social-media research purpose, with ordinary cautions about third-party searches, API charges, and changing software dependencies.

Search terms and filters are sent to SocialDataX, so avoid confidential information and set result limits to control credit use. Prefer a reviewed, fixed package version over @latest and provide only the required API key. The documented account operations are read-only; the downloaded CLI still runs with your local process permissions.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The command executes socialdatax-skills@latest, which is a mutable release tag rather than a pinned version. A compromised or malicious future release could execute with the agent's permissions and access SOCIALDATAX_API_KEY or other accessible data; the documented read-only behavior does not constrain package execution. Although the scanner labels this an MCP server reference, the actual exposure is direct CLI package execution.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The XHS search example executes the mutable socialdatax-skills@latest release through npx. If the package publishing account or a subsequent release is compromised, the command could execute attacker-controlled code with access to the API key and the agent's accessible files. This is another instance of the same supply-chain weakness, not evidence of an already malicious package.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The Douyin hot-search command executes a package selected by the mutable @latest tag. A compromised release could perform arbitrary actions under the agent's permissions, despite the skill describing its business operations as read-only. The API key present in the execution environment increases the potential consequences.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The Douyin search example uses npx to execute socialdatax-skills@latest without a fixed reviewed version. Changes to that release tag can introduce unreviewed code capable of accessing credentials and local resources. This duplicates the supply-chain risk in the other CLI examples rather than establishing a separate attack mechanism.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The Kuaishou hot-search command resolves and executes the mutable @latest release. If an attacker compromises a future package release, the code could steal the API key or modify resources available to the agent. The legitimate hot-search purpose does not remove this execution risk.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The Kuaishou search command executes socialdatax-skills@latest rather than a fixed version. An unauthorized or compromised release could therefore introduce arbitrary code into a process that has access to SOCIALDATAX_API_KEY and potentially other local resources. No package compromise is demonstrated, but the mutable dependency creates a real supply-chain exposure.
Content: No source excerpt is available for this finding.

The skill instructs the agent to submit user-derived search terms to SocialDataX without a privacy disclosure.

Medium

Category: Output Handling
Confidence: 92% confidence
Finding: L065–L067 direct the agent to use the user's actual intent as search keywords in the API-backed workflow, but the skill never warns that these terms are transmitted to the third-party SocialDataX service. The read-only assurances at L193 address account modifications and local browser access, not disclosure of potentially sensitive research topics or business plans.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.