ClawHub
Back to skill

Security audit

小红书博主数据 SocialDataX 博主笔记

Security checks for vulnerabilities and agentic risk

Overview

The skill’s creator-research workflow is coherent and appropriately scoped, with ordinary precautions needed for credentials and downloaded software.

Use a reviewed, fixed CLI version and expose only the credentials and files it needs. Keep API keys out of chat and version control, and set page or item limits to control usage charges. This review covers the bundled instructions; it does not verify the downloaded npm implementation or future releases.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium
Category
MCP Rug Pull
Confidence
99% confidence
Finding

The actual command uses npx -y socialdatax-skills@latest, which automatically executes a mutable package release rather than a reviewed, fixed version. A compromised publisher account or malicious future release could execute code with the agent's permissions and access its API key and other accessible local data; the skill's read-only description does not constrain package execution. This is a direct CLI supply-chain risk, not an MCP server configuration issue as the static label suggests.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium
Category
MCP Rug Pull
Confidence
99% confidence
Finding

The profile-URL example also executes socialdatax-skills@latest with npx -y, accepting an unreviewed changing release without an installation confirmation. If that release is compromised, its code can access the CLI environment, including the SocialDataX credential, regardless of the intended read-only API operation. This repeats the same supply-chain exposure as the user-ID example rather than establishing a separate attack mechanism.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx availability'.

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.