Security audit
Security checks for vulnerabilities and agentic risk
The skill provides purpose-aligned WeChat research through SocialDataX, with no hidden or unrelated actions evident in the submitted instructions.
Search terms, links, identifiers and supplied share text go to SocialDataX, and requests may consume paid credits. Avoid including unrelated private text. Keep your key in local secret storage and out of chat and version control. Prefer a reviewed fixed CLI version with limited access to your files and secrets; its implementation was not included in this review.
The hot-search command executes socialdatax-skills@latest through npx -y, automatically accepting installation of an unpinned release. A compromised package or dependency could execute with the agent's permissions and access its API key; the documented read-only API behavior does not restrict local package execution.
The search command uses @latest, which is a mutable release selector rather than a version pin. Although this is a direct CLI rather than an MCP server launch, compromised package code could run with agent permissions and read credentials.
The skill directs the agent to use commands accepting user-provided keywords and URLs or complete share text for third-party API requests. Although SocialDataX is identified as the provider, the skill does not warn that these inputs leave the user's environment; the read-only safety boundary at L114 does not address this disclosure.
The paginated search example automatically executes an unpinned @latest release. A compromised release or dependency could access the API key and other resources available to the agent, regardless of the search operation's read-only nature.
The detail-by-ID command executes a mutable @latest package through npx -y. If the package supply chain is compromised, the executed code can act with the agent's permissions rather than being limited to retrieving video details.
The detail-by-URL example runs socialdatax-skills@latest without a fixed reviewed version. A malicious upstream update could execute locally and access credentials or workspace data; the intended URL lookup does not constrain that code.
The article lookup command automatically executes an unpinned release using npx -y. A compromised release or dependency could steal the API key or modify accessible files, despite the advertised read-only business operation.
The article-statistics command relies on the mutable @latest tag. Compromise of the selected package or its dependencies could result in code execution with access to the agent's environment and API key.
The comments-by-ID command uses npx -y with @latest, allowing an unreviewed release to be installed and executed. The resulting supply-chain exposure includes credential theft and actions permitted by the agent's local privileges.
The expanded-comments example executes a mutable package release rather than a pinned version. A compromised release can run arbitrary package code with the agent's privileges; pagination and read-only API semantics provide no local execution isolation.
The comments-by-URL command automatically executes socialdatax-skills@latest. A malicious upstream release or dependency could access the API key and other agent-accessible resources, independently of the intended comments lookup.
The replies command invokes an unpinned @latest package with automatic installation approval. If its supply chain is compromised, executed code can access credentials and perform actions beyond the read-only reply retrieval.
The creator-profile-by-ID example executes the mutable @latest release. A compromised package or dependency could run with the agent's local privileges and access its API key, even though the requested API operation is read-only.
The creator-profile-by-URL command automatically executes an unpinned release through npx. An upstream compromise could therefore expose credentials or accessible files, rather than being confined to the documented profile query.
The creator-posts command uses @latest instead of a fixed reviewed package version. Compromised package code could execute with the agent's permissions and read its credentials; the intended content-list operation does not enforce a security boundary.
The all-posts example automatically installs and executes a mutable @latest release. A malicious release or dependency could steal secrets or modify files accessible to the agent, regardless of the read-only API workflow.
The creator-posts-by-URL example executes an unpinned package through npx -y. Compromise of an upstream release or dependency could grant code access to the agent's credentials and environment; this is the same underlying supply-chain weakness as the other CLI examples.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
