Security audit

微博创作者数据 SocialDataX 创作者内容

Security checks for vulnerabilities and agentic risk

Overview

The skill is read-only and purpose-aligned, but it tells agents to automatically run an unpinned remote npm package with the user's API key available.

Review before installing. This skill appears intended for legitimate SocialDataX Weibo data retrieval, but it should ideally pin the npm package version or use a vetted preinstalled tool. Run it in a restricted environment that exposes only SOCIALDATAX_API_KEY and no unrelated secrets or sensitive files.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

Location: SKILL.md:30
Finding: Execution of an Unpinned Remote npm Package
Content: View full analysis
" --pretty --source-client socialdatax-skills \ --source-platform clawhub --source-skill socialdatax-weibo-creator-posts npx -y socialdatax-skills@latest weibo user-posts \ --profile-url "" --pretty --source-client socialdatax-skills \ --source-platform clawhub --source-skill socialdatax-weibo-creator-posts ``` ```text If the current environment has permission, install or restore automatically. ``` ### Technical Analysis The Skill directs the agent to invoke `npx -y socialdatax-skills@latest`. This command resolves the current `latest` npm release, downloads it when necessary, and executes its package entry point. The `-y` option suppresses the normal installation confirmation. Because neither an exact version nor an integrity hash is specified, the code executed at runtime can differ from the code that existed when this Skill was reviewed. The package implementation is not included in the project, so its use of the required `SOCIALDATAX_API_KEY`, its network destinations, and its access to local resources cannot be independently audited here. The documented function legitimately requires network access to retrieve Weibo creator data, and transmitting the API credential to the intended service may therefore be necessary. However, executing mutable package code with access to that credential exceeds the minimum assurance appropriate for this read-only operation. A c ...[truncated 2090 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The skill instructs the agent to execute npx -y socialdatax-skills@latest ..., which fetches and runs the latest package version at runtime without pinning an exact version. If the upstream package is compromised, maliciously updated, or a dependency in its supply chain is poisoned, the agent could execute attacker-controlled code with access to the environment, including SOCIALDATAX_API_KEY and any other accessible secrets.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This is a second instance of the same unsafe execution pattern: npx -y socialdatax-skills@latest ... performs an unpinned runtime install and execution. In an agent context, that creates a software supply-chain risk because arbitrary code from the newest published package version may run automatically and can exfiltrate API keys or alter local state.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.