Security audit

抖音评论分析 SocialDataX 评论洞察

Security checks for vulnerabilities and agentic risk

Overview

The skill fits its Douyin comment-analysis purpose, with disclosed credentials, service charges, and external software dependencies.

Use this for Douyin posts you select and set page or item limits to control charges. Keep the API key in supported secret storage or an untracked local settings file. Prefer a reviewed, pinned CLI version with access only to needed credentials. The bundled instructions were fully inspected; external package behavior and publisher identity remain unverified.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

The activation rule includes generic requests such as audience feedback, pain points, FAQ extraction, and discussion summaries without explicitly requiring a Douyin comment-analysis context.

Medium

Category: Trigger Abuse
Confidence: 88% confidence
Finding: The activation sentence independently lists generic tasks such as audience feedback and FAQ extraction without requiring a Douyin context. This can incorrectly route unrelated requests into an external, potentially billable data workflow. The Douyin-specific title and required content identifiers reduce the likelihood and impact, and there is no evidence of deliberate malicious redirection.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The command executes socialdatax-skills@latest with automatic npm confirmation, allowing the code executed to change without review. A compromised package release could execute with the agent's permissions and access inherited credentials, including SOCIALDATAX_API_KEY; the skill's read-only description does not constrain package execution. This is a direct CLI supply-chain risk, not an MCP-server configuration issue as the finding labels it.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The URL-based example also automatically executes a mutable @latest npm package rather than an approved release. If a future release or its dependencies are compromised, execution could expose the agent's environment credentials or accessible files. The legitimate comment-retrieval purpose does not remove this supply-chain exposure.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The replies command repeats the same mutable-package execution risk by using npx -y socialdatax-skills@latest. An attacker controlling a subsequently selected release could run arbitrary code with the agent's access, despite the intended operation being read-only. This is another occurrence of the same root cause, not an independent attack mechanism.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx availability'.

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.