微博创作者数据 SocialDataX 创作者资料

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:41 AM UTC
• Version: 0.1.18

Overview

The skill is for read-only Weibo profile lookup, but it tells agents to run a mutable npm package at runtime without pinning or integrity checks.

Review before installing. The skill’s data-access purpose is clear and read-only, but it should pin `socialdatax-skills` to an exact reviewed version and ideally include integrity or lockfile controls before agents run it with your API key.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:25

Finding

Unpinned Third-Party npm Package Download and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 25–32; related automatic installation guidance at line 67
Vulnerability Type: Unpinned and unverified third-party dependency execution
Risk Level: High

Vulnerable Code

bash

npx -y socialdatax-skills@latest weibo user-info \
  --user-id "<user_id>" --pretty --source-client socialdatax-skills \
  --source-platform clawhub --source-skill socialdatax-weibo-creator-profile

npx -y socialdatax-skills@latest weibo user-info \
  --profile-url "<profile_url>" --pretty --source-client socialdatax-skills \
  --source-platform clawhub --source-skill socialdatax-weibo-creator-profile

The troubleshooting guidance further states:

text

If the current environment has permission, install or restore automatically.

Technical Analysis

The Skill instructs the agent to use npx -y to retrieve and execute socialdatax-skills@latest. The latest tag is mutable and does not identify a specific reviewed package version. The -y option automatically accepts installation, eliminating an interactive opportunity to inspect or reject the downloaded package.

No package source, lockfile, exact version, or integrity hash is included in the audited project. Consequently, the code executed at runtime can differ from the artifact reviewed during this audit. Automatic dependency installation guidance increases this exposure by encouraging execution without a separate review or explicit approval step.

Exploitation depends on the remote package or its distribution channel becoming malicious, such as through publisher-account compromise, registry compromise, or a malicious future release. The audit did not establish that the current package is malicious; the vulnerability is the unsafe, mutable dependency execution mechanism.

Attack Path

1. An attacker compromises the npm publisher account, package distribution process, or another component ...[truncated 1202 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace socialdatax-skills@latest with an exact, reviewed package version, such as socialdatax-skills@X.Y.Z.
2. Record and verify package integrity using a lockfile, npm integrity metadata, or an independently validated cryptographic digest.
3. Vendor the required implementation into the Skill package when feasible so the executed code is included in security review.
4. Remove -y and require explicit approval before downloading or installing code at runtime.
5. Replace automatic dependency installation guidance with a controlled installation process that presents the exact package version and source to the user.
6. Run the package in a restricted sandbox with minimal filesystem and network permissions.
7. Provide the child process only the environment variables required for the operation rather than inheriting the complete agent environment.
8. Maintain a reviewed-version allowlist and reject execution if the resolved package version or integrity value differs from the approved value.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The skill instructs the agent to execute npx -y socialdatax-skills@latest, which fetches and runs the newest package version at runtime without pinning to a reviewed release. If the npm package is compromised, maliciously updated, or subject to dependency-chain compromise, the agent may execute attacker-controlled code with access to the environment, including SOCIALDATAX_API_KEY and any host permissions available to the runtime.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This second command repeats the same unsafe pattern: npx -y socialdatax-skills@latest performs network retrieval and immediate execution of the latest remote package version. In an agent setting, this expands the supply-chain risk because the invoked code can run non-interactively and may access secrets or perform unexpected actions on the host.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.