Security audit

TikTok 数据助手 SocialDataX

Security checks for vulnerabilities and agentic risk

Overview

The skill provides purpose-aligned TikTok research through SocialDataX, with ordinary third-party data sharing and software dependency risks.

Use public research inputs and avoid including confidential material in queries or pasted share text. Requests may consume paid credits. Keep the API key in a secret store and exclude credential files from version control. Prefer a reviewed, fixed CLI version with limited local access; the external npm code was not included in this review.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

The CLI workflow does not warn that user-supplied research inputs are transmitted to SocialDataX.

Medium

Category: Output Handling
Confidence: 90% confidence
Finding: The preferred workflow instructs the agent to submit user-provided keywords and post URLs or share text through SocialDataX's API. Although the file identifies the provider and explains credential handling, it never explicitly discloses this third-party transmission; the read-only safety boundary at L089 does not address the privacy implications.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The search example executes socialdatax-skills@latest through npx -y, allowing a mutable package release to run without an installation confirmation. A compromised future release could access the API key and other resources available to the agent; the skill's read-only description does not constrain executable package behavior.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The paginated search example runs the mutable @latest package using npx -y. Although this is a direct CLI rather than an MCP server, the underlying supply-chain exposure is real: a compromised release could execute with the agent's permissions and read its credentials.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The post-detail command executes socialdatax-skills@latest rather than a reviewed immutable version. If the package publishing channel is compromised, executing this command could expose the agent's API key or permit unauthorized local actions.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The comments-by-ID example permits unattended execution of whichever release @latest resolves to. This introduces supply-chain risk even though the intended operation only retrieves public comments, because the executable runs with local agent privileges.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The comments-by-URL command uses a mutable @latest dependency with npx -y. A malicious package update could execute outside the documented read-only API behavior and access credentials or local data.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The replies command downloads or resolves executable code through the mutable @latest tag. Compromise of that release channel could turn an ordinary data request into arbitrary execution under the agent's account.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The creator-information command executes an unpinned latest release without an npx installation prompt. An attacker controlling a subsequent package release could obtain the API key or act with the agent's local permissions.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The profile-URL lookup invokes socialdatax-skills@latest, so the code executed may change independently of this skill's review. A compromised release would inherit the command process's credentials and permissions despite the read-only workflow description.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The creator-posts command relies on a mutable npm release tag and unattended npx execution. This is a supply-chain weakness rather than evidence of an existing compromise, but exploitation could expose the API key and other accessible resources.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The profile-based post-list example runs the latest published package rather than a fixed reviewed artifact. A malicious update could execute with the agent's privileges; the intended public-data operation does not limit the package's actual capabilities.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The all-posts example repeats the same mutable @latest execution pattern as the other CLI examples. A compromised release could access credentials or perform unauthorized local operations, regardless of the command's nominally read-only purpose.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx availability'.

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.