Security audit
Security checks for vulnerabilities and agentic risk
The skill coherently supports read-only Douyin research, with ordinary third-party service and software dependency risks.
Use a reviewed fixed CLI version where possible and provide only the needed API key. Lookup inputs are sent to SocialDataX, so remove unrelated private text. Keep local credential settings out of version control and check service credit costs. The scanner's partial reference gaps were investigated, but the downloaded CLI and hosted service remain outside the bundled artifact review.
The hot-search example executes socialdatax-skills@latest through npx -y, automatically accepting installation of a mutable package version. A compromised future release could execute with the agent's permissions and access its environment, including API credentials; this is a CLI supply-chain issue rather than an MCP server reference.
The search example runs a mutable @latest npm release with automatic installation approval. A compromised release could access the agent's credentials and files; the intended read-only search operation does not restrict the executable's permissions.
The skill instructs the agent to run API-backed commands using user-provided keywords, URLs, or copied share text. Although it documents credential handling and read-only behavior, it does not warn that these inputs are transmitted to the third-party SocialDataX service; read-only access does not eliminate this privacy impact.
The paginated search example automatically executes whichever release @latest resolves to. Compromise of the package publishing chain could expose the API key or enable arbitrary actions with the agent's permissions, regardless of the search operation being read-only.
The share-link command executes an unpinned npm release using npx -y. A malicious update could run with the agent's privileges and read credentials; supplying only a content identifier does not mitigate this executable supply-chain risk.
The URL-based share-link example automatically installs and executes a mutable @latest release. A compromised package could access environment secrets and local files; the documented read-only API behavior does not sandbox the CLI.
The detail command uses npx -y with @latest, permitting execution of future releases without a version review. A compromised release could steal the API key or modify accessible files despite the command's read-only purpose.
The URL-based detail command executes a mutable npm release with automatic installation approval. Package compromise could result in code execution with the agent's privileges and credential exposure; this risk concerns the CLI, not an MCP server.
The comments command automatically executes socialdatax-skills@latest rather than a reviewed fixed release. A malicious future version could read the injected API credential and other accessible data, independently of the comments API's read-only semantics.
The comments-and-replies example runs an unpinned @latest package through npx -y. Compromise of a subsequent release could lead to credential theft or unauthorized local actions with the agent's permissions; the read-only workflow does not constrain the package.
The URL-based comments command automatically installs and executes a mutable package version. A compromised npm release could access the agent's API key and files, even though the intended operation only retrieves comments.
The replies command invokes @latest with npx -y, so the executed code can change without changes to the skill. A malicious package update could execute with the agent's permissions and expose environment credentials.
The creator-profile lookup automatically runs an unpinned npm release. A compromised future release could read API credentials or modify accessible files; the command's read-only business function does not limit local code execution.
The profile-URL lookup executes a mutable @latest release with automatic installation approval. Package compromise could expose secrets and allow unauthorized actions under the agent's identity; this is a CLI dependency risk rather than an MCP reference.
The creator-posts command automatically executes whichever package version the @latest tag identifies. A malicious release could access the API key and the agent's local resources, despite the intended operation being read-only.
The all-posts example uses npx -y with a mutable @latest dependency. A compromised update could execute with the agent's privileges and steal injected credentials; pagination options do not alter this supply-chain exposure.
The profile-URL posts command automatically installs and executes an unpinned npm release. Package publishing compromise could permit credential theft or modification of accessible files, notwithstanding the skill's read-only description.
The creator-series command executes socialdatax-skills@latest through npx -y. A compromised future release could run arbitrary code with the agent's permissions and access the API credential; the read-only API operation provides no execution isolation.
The all-series command automatically executes a mutable package release without version review. A malicious update could expose environment secrets or perform unauthorized local actions, regardless of the command's data-retrieval purpose.
The profile-URL series lookup uses npx -y and @latest, allowing the executed package to change independently of the skill. A compromised release could access API credentials and local resources under the agent's permissions.
The user-search example automatically runs an unpinned @latest npm release. A malicious future version could steal credentials or execute unauthorized actions with the agent's privileges; read-only search semantics do not constrain the executable.
The Douyin-ID lookup executes a mutable @latest package through npx -y. A compromised package release could access the API key and other agent-accessible resources; this confirms a CLI supply-chain weakness, not an MCP server configuration issue.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
