Security audit

短视频文案一键提取

Security checks for vulnerabilities and agentic risk

Overview

The skill coherently supports public-video transcription, with disclosed API-key use and ordinary third-party package risks.

Submit only intended public-video links, protect your SocialDataX API key, and check service charges. Prefer a reviewed, fixed CLI version. External package code and publisher identity were not independently verified; the supplied static scan reported no findings.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (15)

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The command executes socialdatax-skills@latest through npx -y, automatically accepting installation of a mutable package release. A compromised release could execute with the agent's permissions and access SOCIALDATAX_API_KEY or other accessible data; this is a direct CLI invocation rather than an MCP server, but the supply-chain concern remains valid.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The content-ID command executes a mutable @latest package using npx -y rather than a reviewed, fixed release. If the package publication channel is compromised, malicious code could run locally and access the API key despite the documented read-only purpose.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The job-status command invokes socialdatax-skills@latest with automatic installation approval. Even a status-only operation therefore depends on mutable executable code that, if compromised, could access local data and the runtime API key.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The Douyin URL command automatically executes the package selected by the mutable @latest tag. A malicious or compromised future release could run with the agent's permissions and steal credentials; using the package for legitimate transcription does not constrain its local capabilities.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: This command runs socialdatax-skills@latest through npx -y, leaving the executed release uncontrolled. A compromised update could execute arbitrary local code with access to SOCIALDATAX_API_KEY, regardless of the limited content-ID operation requested.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The Douyin polling command executes a mutable package release with npx -y. Reusing this command for status checks preserves exposure to compromised package code, which could access credentials and local resources despite the read-only API operation.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The Kuaishou URL command automatically runs whichever release @latest resolves to. Compromise of that release or its dependencies could lead to code execution under the agent's account, including access to the configured API key.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The photo-ID command uses npx -y with @latest rather than an immutable, reviewed release. This creates a conditional supply-chain execution risk: compromised package code could read the API key or modify accessible local files.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The Kuaishou status command executes the mutable @latest package through npx -y. The limited purpose of querying a job does not prevent a compromised release from executing arbitrary code or accessing environment credentials.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The Weibo URL command permits automatic execution of an unpinned @latest release. If the package distribution channel is compromised, the executable can access the agent's local privileges and SOCIALDATAX_API_KEY; the documented read-only behavior is not an enforced sandbox.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The post-ID invocation automatically executes socialdatax-skills@latest, so the code can change without review of this skill. A compromised release could steal credentials or alter accessible files with the agent's permissions.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The Weibo polling example uses npx -y to execute a mutable package release. Although the requested operation only retrieves status, compromised package code would still have local execution capabilities and access to the API credential.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The WeChat URL command executes the mutable @latest package with automatic installation approval. A compromised update could execute under the agent's account and access credentials, independent of the intended public-video transcription workflow.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: This encrypted-object-ID command runs socialdatax-skills@latest without fixing the executable release. Compromise of the package or its resolved dependencies could result in local code execution and API-key theft; the input identifier does not reduce that supply-chain exposure.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The WeChat job-status command uses npx -y with a mutable @latest release, exposing even polling operations to unreviewed executable changes. If a release is compromised, it could access SOCIALDATAX_API_KEY and other resources available to the agent.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.