抖音数据分析 SocialDataX 作品搜索

• Outcome: Pass
• Latest audit: Nov 3, 2026 · 9:14 AM UTC
• Version: 0.1.22

Overview

The skill describes a coherent Douyin search integration, with ordinary third-party service, credential, and package-installation risks.

Use this for Douyin research and expect queries and usage attribution to reach SocialDataX; requests may consume credits. Keep the API key in a protected secret store and avoid confidential search terms. Prefer a reviewed, pinned CLI release with access only to necessary credentials. This review covers the bundled instructions; external CLI code and publisher provenance could not be verified.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (8)

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The hot-search example executes socialdatax-skills@latest through npx -y, allowing a changing package release to run without an installation confirmation. A compromised release or dependency could execute with the agent process's permissions and access its API key and other accessible resources; the documented read-only API workflow does not constrain package execution.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The keyword-search example uses npx -y socialdatax-skills@latest, so the executed package is not fixed to a reviewed release. A malicious future release or compromised dependency could run arbitrary code with access to the agent's environment, including its API credential.

Content

No source excerpt is available for this finding.

The search workflow sends user-derived keywords to SocialDataX without an explicit privacy disclosure.

Medium

• Category: Output Handling
• Confidence: 86% confidence

Finding

The skill instructs the agent to execute searches using keywords derived from the user's actual intent, but does not warn that those terms are transmitted to the third-party SocialDataX service. The read-only safety statement addresses account changes and local browser access, not disclosure of potentially sensitive search terms.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The multi-page search example also executes the mutable @latest npm release with automatic confirmation. This creates the same supply-chain exposure as the other CLI examples: package code can access the execution environment regardless of whether the intended API operation is read-only.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The user-search command downloads and executes socialdatax-skills using the mutable @latest tag and npx -y. Although this is a direct CLI rather than an MCP server, the substantive unpinned-code execution risk remains and could expose the API key or other agent-accessible data if the package is compromised.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md

- `--max-items <n>`: stop after collecting N search results.
- `--source-client socialdatax-skills --source-platform clawhub --source-skill socialdatax-douyin-search`: usage attribution for this Agent Skill; keep these values unchanged when running examples from this Skill.

Use `douyin hot-search` for the current Douyin main hot-search list. Do not ask the user for `--keyword` for this command.
Douyin sort values:
- `general`: default sorting.
- `time_descending`: newest first.

MCP server referenced without pinned version: 'npx availability'.

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Activation guidance includes generic research requests without explicitly requiring a Douyin context.

Low

• Category: Trigger Abuse
• Confidence: 88% confidence

Finding

The invocation instruction lists "content research," "competitor analysis," and "trend scanning" as standalone activation conditions. Although the surrounding skill concerns Douyin, this instruction does not explicitly constrain those broad requests to Douyin and could trigger the skill for unrelated research.

Content

No source excerpt is available for this finding.