抖音数据助手 SocialDataX

• Outcome: Review
• Latest audit: Sep 18, 2026 · 6:58 AM UTC
• Version: 0.1.18

Overview

This Douyin data skill appears read-only and purpose-aligned, but it repeatedly runs an unpinned npm package with access to the user's SocialDataX API key.

Install only if you are comfortable letting the current npm release of socialdatax-skills run in your agent environment with access to SOCIALDATAX_API_KEY. Prefer a pinned, reviewed package version or a constrained execution environment that exposes only the needed API key.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (20)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The skill repeatedly instructs the agent to execute `npx -y socialdatax-skills@latest`, which fetches and runs the newest package version at runtime rather than a reviewed, immutable release. If the npm package is compromised, hijacked, or updated with malicious code, the agent could execute attacker-controlled code with access to the user's environment, including `SOCIALDATAX_API_KEY` and any other inherited process permissions.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: This command uses `npx -y socialdatax-skills@latest`, causing runtime retrieval and execution of mutable upstream code. An attacker who gains control of the package or publication pipeline could deliver arbitrary code that runs in the agent context and can access environment variables and network capabilities.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The skill recommends executing an npm package directly from the registry using `@latest`, which is a supply-chain risk because the exact code is not fixed. In an agent setting, this is especially dangerous because the executed package may receive sensitive inputs and inherited credentials from the runtime environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: Using `npx -y socialdatax-skills@latest` means the command will execute whatever code is currently published as the latest release, not necessarily the version originally validated with the skill. A compromised release could exfiltrate the configured API key or run arbitrary postinstall/runtime logic under the agent's permissions.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: This is another instance of runtime execution of a mutable npm package via `npx` and `@latest`. The danger is code execution from an unpinned supply source, which can be exploited through package compromise, maintainer account takeover, or malicious upstream updates.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The command references `socialdatax-skills@latest`, so the artifact executed can change over time without changes to the skill file. That creates a supply-chain execution vector where malicious package updates could execute in the user's environment and access the API key specified by the skill.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: Fetching and running the latest npm package at execution time is a real security issue because the package contents are not stable or locally audited. In this skill, the risk is amplified by explicit reliance on an environment-resident secret (`SOCIALDATAX_API_KEY`) that a malicious package could read or exfiltrate.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: This example also executes `socialdatax-skills@latest` via `npx`, creating a mutable-code execution path. If the upstream package is tampered with, the agent may unknowingly run malicious code capable of stealing credentials, altering outputs, or pivoting through available system/network access.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: Because this command uses `@latest`, the actual code executed is determined at runtime by the current registry state. That exposes the agent to package compromise and dependency-chain attacks, with possible arbitrary code execution and secret leakage from the host environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: Running `npx -y socialdatax-skills@latest` is a true vulnerability because it trusts a moving target from the npm registry. In the context of an agent skill, that can translate into remote code execution with access to user-provided inputs, output channels, and environment secrets.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: This instruction downloads and executes the latest package release at runtime, which is a standard software supply-chain risk. If an attacker publishes a malicious update or compromises the package account, the agent may execute arbitrary code and expose the API key or other accessible data.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The repeated use of `socialdatax-skills@latest` means the skill's behavior depends on mutable external code that can change independently of the skill. This creates an avoidable attack surface for arbitrary code execution and credential exfiltration in the agent runtime.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: This is another true positive for unpinned runtime code execution: the command pulls the latest package from npm and runs it immediately. A malicious or compromised release could alter command semantics, return falsified data, or steal secrets available in the process environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: By instructing use of `npx -y socialdatax-skills@latest`, the skill delegates execution to a mutable registry artifact. In a tool that explicitly uses an API key from the environment, that creates a credible path to secret theft and arbitrary code execution if the package supply chain is compromised.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: This command continues the same risky pattern of executing an unpinned npm package at runtime. Since the package can change without notice, attackers could weaponize the update path to run arbitrary code or manipulate collected Douyin data within the agent session.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The use of `@latest` here is dangerous because it removes version immutability and makes the executed code dependent on current upstream publication state. In practice, that means a compromised package release could gain access to the API key and whatever local/network permissions the agent process holds.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: This is a true vulnerability stemming from direct execution of mutable npm content. Even though the skill is described as read-only, the executed package itself would still have code execution rights in the environment, so a malicious update could perform actions unrelated to the stated business logic.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: Executing `socialdatax-skills@latest` at runtime exposes the agent to package substitution and malicious update attacks. Because the skill encourages ongoing operational use, the window for exploitation persists over time as future package releases are automatically trusted.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: This final command example still relies on `@latest`, so it inherits the same supply-chain and remote code execution risk as the other instances. The presence of an environment API key and the possibility of broader inherited process access make exploitation materially impactful despite the skill's narrow functional scope.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Static analysis

No suspicious patterns detected.