T08 · Insecure Dependencies
Warning
- Location
SKILL.md:25- Finding
Unpinned npm Package Is Downloaded and Executed Automatically
- Content
View full analysis
- Remediation
View remediation
Security audit
微博数据助手 SocialDataX
Security checks for vulnerabilities and agentic risk
Overview
This Weibo data skill appears purpose-aligned and read-only, but it repeatedly runs an unpinned npm package with an API key available, so users should review the supply-chain risk before installing.
Install only if you trust the SocialDataX npm package and are comfortable with latest-tag npm execution. Prefer running it in a restricted environment with only SOCIALDATAX_API_KEY exposed, no unrelated secrets, limited filesystem access, and a pinned reviewed package version if possible.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (17)
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
The skill instructs the agent to execute a package via
npx -y socialdatax-skills@latest, which fetches and runs whatever code is current in the npm registry at execution time. This creates a software supply-chain risk: if the package is compromised, typo-squatted, or a malicious update is published, arbitrary code could run in the agent environment and access environment variables such asSOCIALDATAX_API_KEYor other local resources.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
This command uses
npxwithsocialdatax-skills@latest, causing unreviewed remote code to be downloaded and executed on demand. An attacker who gains control of the package or its distribution path could execute arbitrary code and potentially exfiltrate secrets or alter agent behavior.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
Running
npx -y socialdatax-skills@latestintroduces a live dependency on the current npm package contents rather than a fixed reviewed artifact. That means any future malicious or vulnerable release would immediately affect users of the skill and could run arbitrary code in the host environment.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
The command example executes a registry-fetched package using
@latest, which is a classic supply-chain exposure. Because the skill also expects an API key in the environment, compromise of the executed package could lead to credential theft or arbitrary command execution.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
This line again instructs runtime execution of the latest npm package version, which is not stable or reviewable over time. If the package is hijacked or updated maliciously, the agent could run attacker-controlled code with access to local permissions and secrets.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
On-demand execution of
socialdatax-skills@latestmeans the trust boundary extends to the npm supply chain at every invocation. A malicious update could exploit the agent runtime, harvestSOCIALDATAX_API_KEY, or perform unauthorized system/network actions under the agent's privileges.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
Because this command resolves
@latestat runtime, users are exposed to whatever code is most recently published rather than a vetted release. That creates a practical arbitrary-code-execution path through package compromise or malicious maintainer action.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
The skill repeatedly encourages
npxexecution of a latest-tagged package, which is inherently unsafe in privileged agent environments. This can enable remote code execution and secret access if the upstream package or dependency chain is compromised.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
This example relies on
npxfetching current package code, which undermines reproducibility and security review. If the package or one of its install-time/runtime dependencies becomes malicious, the agent may execute arbitrary code and expose environment data.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
Executing
socialdatax-skills@latestfrom npm on each run presents a supply-chain attack surface. In the context of an agent skill with environment-provided credentials, compromise could lead to API key exfiltration, host compromise, or deceptive output.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
The command dynamically trusts the npm latest tag rather than a fixed reviewed build. That allows any malicious or vulnerable upstream release to be executed immediately in the user/agent context, with potential access to secrets and filesystem/network capabilities.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
Using
npx -y ...@latestin the documentation creates a direct pathway for executing unvetted third-party code. Since the skill is meant for routine use, repeated execution increases exposure to compromise of the package or dependency ecosystem.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
This line has the same core issue: arbitrary remote package code is implicitly trusted and executed based on the moving
latesttag. In an environment holdingSOCIALDATAX_API_KEY, a compromised package could steal credentials or perform unauthorized actions through available system access.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
The skill example executes a non-pinned npm package, making the security posture depend on the current state of the public registry. That is dangerous because package takeover or malicious release would translate into immediate code execution in the agent runtime.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
npxwith@latestdownloads and runs code that may differ over time, bypassing reproducible review. That exposes the agent to supply-chain attacks capable of arbitrary code execution, data exfiltration, and misuse of environment-based credentials.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
This command repeats the pattern of unpinned remote execution from npm, which is a genuine vulnerability in agent tooling. The skill context makes it more dangerous because the tool is intended to run with an API key present and potentially broad shell/network access.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Static analysis
No suspicious patterns detected.