Security audit

社媒素材保存整理

Security checks for vulnerabilities and agentic risk

Overview

The skill clearly limits its work to saving media from user-selected links, with ordinary risks from running an external download tool.

Choose explicit links and an output folder. Online lookups send those links to SocialDataX and may consume API credits; direct media downloads contact the media host. Keep the API key in supported secret storage. Prefer a reviewed, pinned CLI version and restrict its file access. This review covers the supplied instructions, not the external npm implementation.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (7)

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The command uses socialdatax-skills@latest, allowing execution of a changing npm release without version review, while -y suppresses the installation confirmation. A compromised release could execute with the agent's permissions and access API credentials or local files; this is a CLI rather than an MCP server, but the supply-chain concern still applies.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The Douyin command automatically executes the mutable @latest npm release rather than a reviewed, fixed dependency. If that release is compromised, its code can access the agent's environment, including available API keys, and operate outside the skill's stated download-only boundaries.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The Kuaishou command uses npx -y with @latest, so a newly published package version may run without an explicit dependency-review step. A malicious release would inherit the command process's access to secrets and files; the skill's written restrictions do not technically constrain that executable.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The Weibo invocation executes a mutable npm release through npx -y rather than a fixed, reviewed version. Compromise of the package's publication path could therefore lead to code execution with the agent's privileges, including access to API credentials and local data.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The X/Twitter command resolves socialdatax-skills@latest at execution time, permitting unreviewed package updates to become executable agent code. A compromised release could read credentials, exfiltrate local data, or alter accessible files despite the skill's stated read-only intent.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The Bilibili download command automatically runs the mutable @latest package with access to the execution environment and output directory. A compromised release could misuse available credentials or write beyond the requested directory because those boundaries are instructions, not an enforced sandbox.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The shared instruction requires local download subcommands to run through npx -y socialdatax-skills@latest, extending the same mutable dependency risk to media-only operations. Although those operations do not require an API key, the executable can still access any secrets and files available to its process.
Content: No source excerpt is available for this finding.