ClawHub
Back to skill

Security audit

抖音达人数据 SocialDataX 达人信息

Security checks for vulnerabilities and agentic risk

Overview

The skill’s creator lookups fit its stated purpose, with disclosed credential setup and ordinary risks from downloading external software.

Use a dedicated API key, keep credential settings out of version control, and expect API calls to consume credits. Prefer a reviewed, pinned CLI version. The supplied instructions were fully inspected; the external package’s executable behavior remains unverified.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium
Category
MCP Rug Pull
Confidence
99% confidence
Finding

The command executes socialdatax-skills@latest, a mutable package reference, with npx -y automatically accepting installation. A compromised or malicious future release could execute with the agent's permissions and access its environment, including the API key; the stated read-only API scope does not restrict local package execution. This is a CLI supply-chain issue rather than an MCP server configuration issue.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium
Category
MCP Rug Pull
Confidence
99% confidence
Finding

This profile-URL command also runs socialdatax-skills@latest without a fixed, reviewed version and automatically accepts installation. A compromised release could run arbitrary code with the agent's privileges and obtain accessible credentials or files, despite the skill's intended read-only data lookup functionality. There is no evidence in the supplied content that such a compromise has occurred.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium
Category
MCP Rug Pull
Confidence
99% confidence
Finding

The Douyin-ID command repeats the same mutable @latest dependency execution pattern. If a future package release is compromised, npx -y could install and execute it without a separate confirmation, exposing the agent's accessible files and API credentials. The authenticated CLI context increases the potential consequences of this supply-chain weakness.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx availability'.

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.