ClawHub
Back to skill

Security audit

微博数据分析 SocialDataX 内容研究

Security checks for vulnerabilities and agentic risk

Overview

The skill is read-only for Weibo research, but it tells agents to download and run a mutable npm package at runtime with the user's API key available.

Review before installing. This skill's intended Weibo search behavior is coherent and read-only, but only use it in an environment where running the latest npm package is acceptable, with a scoped SOCIALDATAX_API_KEY and minimal other secrets exposed. A pinned, reviewed package version would reduce the main risk.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
SKILL.md:32
Finding

Unpinned npm Package Is Downloaded and Executed at Runtime

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 32–44
Vulnerability Type: Runtime execution of an unpinned third-party dependency
Risk Level: High

Vulnerable Code

bash
npx -y socialdatax-skills@latest weibo hot-search \
  --pretty --source-client socialdatax-skills --source-platform clawhub \
  --source-skill socialdatax-weibo-search

npx -y socialdatax-skills@latest weibo search \
  --keyword "<keyword>" --pretty --source-client socialdatax-skills \
  --source-platform clawhub --source-skill socialdatax-weibo-search

npx -y socialdatax-skills@latest weibo search \
  --keyword "<keyword>" --pages 3 --pretty --source-client socialdatax-skills \
  --source-platform clawhub --source-skill socialdatax-weibo-search

The related metadata and troubleshooting instructions also declare the unpinned package and encourage automatic installation when permission is available:

text
"install":[{"kind":"node","package":"socialdatax-skills","bins":[]}]

If the current environment has permission, install or restore automatically.

Technical Analysis

The Skill instructs the Agent to invoke npx -y socialdatax-skills@latest. The @latest tag is mutable and therefore does not identify the package version that was reviewed. The -y option automatically accepts installation prompts, allowing npm to retrieve and execute the currently published package without an explicit user confirmation step.

No exact version, package-lock file, integrity hash, vendored source, or other reproducible dependency control is provided. Consequently, the effective executable payload can change after this Skill has been audited. This creates a supply-chain trust boundary in which the npm publisher account, package registry, package release process, and all transitive dependencies can affect runtime behavior.

The package executes in an environment where SOCIALDATAX_API_KEY is available. It also ...[truncated 2334 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace socialdatax-skills@latest with an exact, reviewed version such as socialdatax-skills@X.Y.Z. Do not use mutable npm tags or semver ranges for runtime execution.
  2. Commit a lockfile that records exact transitive dependency versions and npm integrity values. Install with a reproducible command such as npm ci.
  3. Verify the package source, publisher identity, registry origin, signatures or provenance attestations, and integrity hash before execution.
  4. Remove -y and do not automatically install or restore executable dependencies. Require explicit authorization before downloading or executing a package that is not already trusted and installed.
  5. Prefer shipping reviewable source code with the Skill or invoking a preinstalled, administrator-approved binary rather than downloading code during each use.
  6. Run the CLI in a sandbox with minimal filesystem access, a restricted environment, and outbound network access limited to documented SocialDataX endpoints.
  7. Provide only SOCIALDATAX_API_KEY and the minimum required arguments to the child process. Do not inherit unrelated credentials or sensitive environment variables.
  8. Document that search keywords are transmitted to SocialDataX and advise users not to include passwords, tokens, private keys, or other secrets in search queries.
  9. Add dependency scanning and release review to the update process before changing the pinned package version.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

The skill instructs the agent to execute npx -y socialdatax-skills@latest, which fetches and runs the newest package version at runtime without pinning to a vetted release. If the upstream package is compromised, a malicious version is published, or the package behavior changes unexpectedly, the agent could execute arbitrary code in its environment using available permissions and secrets such as SOCIALDATAX_API_KEY.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

This is another runtime invocation of npx -y socialdatax-skills@latest for search functionality, carrying the same supply-chain risk as line 30. Because the package is resolved dynamically at execution time, a compromised or changed upstream release could run arbitrary code before or instead of the intended Weibo query.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

The multi-page search example also uses npx -y socialdatax-skills@latest, again causing unpinned remote code execution. Repetition across examples increases the chance an agent will follow this unsafe pattern, making compromise of the package or registry an effective attack path.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md
- Weibo `--pages <n>`: fetch and merge N search pages from the current starting point; continue with returned `next_page_token`.
- `--source-client socialdatax-skills --source-platform clawhub --source-skill socialdatax-weibo-search`: usage attribution for this Agent Skill; keep these values unchanged when running examples from this Skill.

Use `weibo hot-search` for the current Weibo / 微博 hot-search list. Do not ask the user for `--keyword` for this command.
The command prints JSON with `platform`, `tool`, `arguments`, and `data`. Search supports `--pages` and `--max-items`, but not `--all`, because search has no stable complete-result boundary. Multi-page output keeps merged results in `data.items` and adds `page_count`, `item_count`, and the next-page marker.

## Safety Boundary

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.