Security audit

Instagram 数据助手 SocialDataX

Security checks for vulnerabilities and agentic risk

Overview

The skill coherently supports Instagram research through SocialDataX, with disclosed credential use and ordinary third-party software risks.

Use inputs you are comfortable sharing with SocialDataX, protect the API key, and review API-credit costs before large requests. Prefer a reviewed, fixed CLI version with limited access to unrelated files and secrets. This review covers the bundled instructions; it does not verify the external npm package or hosted service.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (13)

The CLI workflow sends user-supplied research inputs to SocialDataX without an explicit privacy disclosure.

Medium

Category: Output Handling
Confidence: 88% confidence
Finding: The skill instructs the agent to execute API-backed commands containing search keywords, post URLs or share text, and creator identifiers. Although it documents credential handling and describes the skill as read-only, it does not warn users that these inputs are transmitted to the third-party SocialDataX service; read-only access does not eliminate that privacy impact.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The search example executes socialdatax-skills@latest through npx -y, automatically accepting a mutable package release rather than a reviewed version. A compromised release or dependency could execute with the agent's permissions and access its API key and other accessible resources; the documented read-only API scope does not constrain local package execution.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The paginated search example uses npx -y with the mutable @latest tag, allowing package code to change without a skill update or review. A compromised release could steal the API key or act with the agent's local privileges; this is another occurrence of the same supply-chain weakness.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The post-detail command automatically executes the package selected by @latest instead of a fixed reviewed release. If that release or its dependencies are compromised, the code can access the API key and resources available to the agent, irrespective of the intended read-only operation.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The URL-based detail example invokes socialdatax-skills@latest with automatic installation acceptance. This creates a supply-chain execution risk because a future compromised release can run with the agent's permissions and read its runtime credentials.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The comments command executes a mutable npm release through npx -y. A malicious or compromised package update could access runtime secrets or perform local actions beyond comment retrieval, so the skill's read-only description does not eliminate this risk.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The replies command uses @latest, which does not identify an immutable reviewed version. Automatic execution of a compromised release or dependency could expose the SocialDataX API key and other resources accessible to the command process.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The username-based profile command runs socialdatax-skills@latest with npx -y, trusting whatever release the tag selects. Compromise of that release or its dependencies would permit code execution with the agent's privileges and access to its API credential.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The profile-URL command automatically executes an unpinned package release. A compromised update could steal credentials or alter accessible local data even though the requested API operation only reads a profile.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The username-based post-list command uses the mutable @latest tag with automatic npm installation acceptance. This permits an unreviewed future release to execute with the agent's privileges and access its runtime credentials.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The profile-URL post-list example executes socialdatax-skills@latest rather than a fixed audited version. A compromised package release or dependency could access the API key and perform actions beyond the documented read-only workflow.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The all-posts example repeats the automatic execution of a mutable @latest package. The security issue is the package execution trust boundary, not pagination: a compromised release could use the agent's permissions to access secrets or local resources.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx availability'.

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.