Security audit

socialdatax-xhs-comments

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent read-only XHS comment helper, but it tells agents to run a mutable npm package with an API key, which deserves user review before installation.

Install only if you are comfortable with SocialDataX and the npm package execution path. Prefer a pinned, reviewed package version or an already-configured trusted MCP tool, and run it with a minimal environment containing only the required SocialDataX API key.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

Location: SKILL.md:29
Finding: Unpinned Third-Party npm Package Is Downloaded and Executed with Access to an API Key
Content: View full analysis
" --pretty --source-client socialdatax-skills \ --source-platform clawhub --source-skill socialdatax-xhs-comments npx -y socialdatax-skills@latest xhs comments \ --url "" --pretty --source-client socialdatax-skills \ --source-platform clawhub --source-skill socialdatax-xhs-comments npx -y socialdatax-skills@latest xhs sub-comments \ --note-id "" --comment-id "" --pretty \ --source-client socialdatax-skills --source-platform clawhub \ --source-skill socialdatax-xhs-comments ``` ### Technical Analysis The Skill directs the agent to download and execute `socialdatax-skills@latest` from npm. The `latest` tag is mutable, so the code executed during a future invocation may differ from the code that existed when the Skill was reviewed. No exact package version, lockfile, or package-integrity value is specified. The `npx -y` option suppresses the normal installation confirmation, allowing the remote package to be fetched and executed automatically. The Skill also declares `SOCIALDATAX_API_KEY` as a required environment variable. Unless the execution environment explicitly filters inherited variables, the downloaded Node.js process can read that API key and potentially other environment variables available to the parent agent. Remote API access and transmission of the API key to the intended SocialDataX service are consistent with the declared comment-retri ...[truncated 1969 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The file prominently describes the skill in Chinese and gives Chinese-only operational guidance such as '获取或管理 API Key', without stating that language should follow user preference or offering a language choice. This may violate language/locale policy when used with users who did not opt into Chinese responses.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The 'Use this skill when' line includes generic phrases such as 'user feedback,' 'pain points,' 'FAQ extraction,' and 'discussion summaries' without clear constraints distinguishing XHS-specific use from ordinary conversational requests. This can cause unintended invocation because the trigger scope is broad and lacks negative examples or exclusion conditions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill instructs the agent to execute npx -y socialdatax-skills@latest, which fetches and runs the newest package version at execution time rather than a reviewed, fixed version. This creates a supply-chain risk: a compromised publisher account, malicious update, or breaking change could cause arbitrary code execution in the agent environment.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This invocation again uses npx -y socialdatax-skills@latest, causing dynamic retrieval and execution of whatever code is current in the package registry. In an agent context, that turns normal skill use into remote code execution through an unpinned dependency path.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The sub-comments example also relies on npx -y ...@latest, exposing the same unpinned execution path. Because the skill explicitly prefers direct CLI execution, this pattern is operationally significant and increases the chance that agents will run unreviewed code from the registry.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.