抖音达人数据 SocialDataX 达人作品

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:21 AM UTC
• Version: 0.1.18

Overview

This read-only Douyin data skill is purpose-aligned, but it needs Review because it runs an unpinned npm package with the user's SocialDataX API key.

Use this only if you trust the SocialDataX npm package and registry path. Prefer a pinned, reviewed package version, approve installs or upgrades explicitly, run it with only SOCIALDATAX_API_KEY in the environment, and cap page counts when API cost or volume matters.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:30
• Finding: Unpinned npm Package Is Downloaded and Executed Without Confirmation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 30–46; related installation metadata at line 7 and automatic restoration guidance at line 96 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```bash npx -y socialdatax-skills@latest douyin user-posts \ --sec-user-id "<sec_user_id>" --pretty --source-client socialdatax-skills \ --source-platform clawhub --source-skill socialdatax-douyin-creator-videos npx -y socialdatax-skills@latest douyin user-posts \ --profile-url "<profile_url_or_share_text>" --pretty \ --source-client socialdatax-skills --source-platform clawhub \ --source-skill socialdatax-douyin-creator-videos npx -y socialdatax-skills@latest douyin user-series \ --sec-user-id "<sec_user_id>" --pretty --source-client socialdatax-skills \ --source-platform clawhub --source-skill socialdatax-douyin-creator-videos npx -y socialdatax-skills@latest douyin user-series \ --profile-url "<profile_url_or_share_text>" --pretty \ --source-client socialdatax-skills --source-platform clawhub \ --source-skill socialdatax-douyin-creator-videos ``` Related unconstrained installation metadata at line 7: ```text "install":[{"kind":"node","package":"socialdatax-skills","bins":[]}] ``` Related automatic dependency-restoration instruction at line 96: ```text If the current environment has permission, install or restore automatically. ``` ### Technical Analysis The documented commands use `npx -y`, which can download and execute an npm package without interactive confirmation. The `@latest` version selector does not identify a fixed, previously audited release. Consequently, the code executed by the Skill can change after the Skill itself has been reviewed. The installation metadata also specifies `socialdatax-skills` without a version constraint, while the troubleshooting guidance encourages automatic installation or restoration. Together, these behaviors create a supply-chain t ...[truncated 2625 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with an exact, reviewed package version, for example: ```bash npx -y socialdatax-skills@<audited-exact-version> ... ``` 2. Pin the package version in the Skill installation metadata instead of declaring only the package name. 3. Verify package integrity using a trusted lockfile, registry integrity hash, signed release, or an equivalent reproducible verification mechanism. 4. Remove or narrow the instruction to install or restore dependencies automatically. Require explicit user approval before first installation, reinstallation, or version upgrades. 5. Do not silently upgrade the dependency. Review each new version before updating the pinned version and integrity value. 6. Launch the CLI with a minimal environment containing only variables required for the operation. Avoid passing unrelated secrets to the child process. 7. Restrict the process with filesystem sandboxing, outbound-network controls, and a non-privileged operating-system identity. 8. Prefer a preinstalled and administrator-approved executable or an already configured MCP tool when available, rather than downloading executable code during each invocation. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: The file includes imperative Chinese-language guidance for how to instruct the user about obtaining or managing the API key, but does not state that language choice should follow user preference. This can violate language/locale policy when the user has not opted into Chinese or bilingual responses.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The skill instructs the agent to execute `npx -y socialdatax-skills@latest ...`, which downloads and runs whatever package version is current at execution time. This creates a software supply-chain risk: a compromised publisher account, malicious new release, or dependency takeover could cause arbitrary code execution in the agent environment with access to environment variables such as `SOCIALDATAX_API_KEY`.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: This invocation again relies on `npx -y socialdatax-skills@latest`, allowing unreviewed remote code to be fetched and executed during normal skill use. In an agent setting, that code may access the filesystem, network, and sensitive environment data, making compromise materially impactful.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: Using `npx` with `@latest` for the series command has the same supply-chain exposure as the other examples: the executed code is not fixed or reviewed at the time the skill is authored. A malicious or compromised package update could run arbitrary commands and exfiltrate API keys or collected data.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: This command repeats the unpinned `npx -y ...@latest` pattern, which is a classic remote package execution risk. Because the skill explicitly encourages shell execution, exploitation would be straightforward if the upstream package or dependency chain were compromised.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Static analysis

No suspicious patterns detected.