socialdatax-xhs-detail

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:48 AM UTC
• Version: 0.1.15

Overview

The skill has a coherent SocialDataX/XHS note-detail purpose, but it asks agents to run an unpinned npm package and to preserve token-bearing URLs in broad contexts.

Review this skill before installing. Use it only in an environment where running npm packages is acceptable, prefer a pinned and reviewed socialdatax-skills version, expose only the needed SOCIALDATAX_API_KEY, and avoid forwarding or storing full xsec_token-bearing URLs unless the user explicitly needs a directly openable link.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:29
• Finding: Execution of an Unpinned npm Package from the Mutable Latest Release<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 29-35; additional occurrence at line 61 **Vulnerability Type**: Supply-chain risk caused by unpinned remote package execution **Risk Level**: High ### Vulnerable Code ```bash npx -y socialdatax-skills@latest xhs detail \ --note-id "<note_id>" --pretty --source-client socialdatax-skills \ --source-platform clawhub --source-skill socialdatax-xhs-detail npx -y socialdatax-skills@latest xhs detail \ --url "<note_url_or_share_text>" --pretty --source-client socialdatax-skills \ --source-platform clawhub --source-skill socialdatax-xhs-detail ``` The same unsafe package reference is used by the media-download instruction at line 61: ```text When the user wants to save XHS images or videos after detail, pass each returned `image_items[].image_url`, `image_items[].live_photo.video_url`, or `video.video_url` to `npx -y socialdatax-skills@latest xhs download-media --url "<media_url>" --output-dir <directory> --pretty`; this local save command does not require `SOCIALDATAX_API_KEY`. ``` ### Technical Analysis The skill directs the agent to execute `socialdatax-skills@latest` through `npx -y`. The `latest` npm tag is mutable and does not identify the specific package version that was reviewed. The `-y` option also allows installation and execution without an interactive confirmation step. Consequently, the effective code executed by the skill can change after this document has been audited. A malicious future release, compromised publisher account, or compromised npm distribution path could cause arbitrary package code to execute locally. Package lifecycle scripts or the package CLI may execute with the same operating-system privileges and environment access as the agent process. This is a supply-chain weakness rather than evidence that the current package release is malicious. ### Attack Path 1. An attacker compromises the npm publisher account, release pipeline, or another mechanism ...[truncated 1270 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with an exact, reviewed package version, such as `socialdatax-skills@X.Y.Z`. 2. Install dependencies through a committed lockfile that records exact transitive versions and package integrity hashes. 3. Prefer a preinstalled, reviewed package over downloading executable code during each skill invocation. 4. Verify package provenance and integrity through npm signatures, trusted publishing metadata, or an internally approved registry. 5. Disable npm lifecycle scripts where they are unnecessary, for example by using an installation process configured with `--ignore-scripts`. 6. Run the CLI in a sandbox with minimal filesystem and network permissions. 7. Expose `SOCIALDATAX_API_KEY` only to the specific process that requires it, and avoid placing unrelated credentials in that process environment. 8. Apply the same version pinning and verification controls to both detail retrieval and `download-media` commands. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:58
• Finding: Mandatory Disclosure and Forwarding of Token-Bearing Note URLs<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 58 **Vulnerability Type**: Unsafe handling and propagation of sensitive URL query parameters **Risk Level**: Medium ### Vulnerable Code ```text For XHS detail results, in every use of a returned `note_url`, such as final answers, display, references, storage, output, or forwarding, preserve it exactly as the full URL, including `xsec_token` query parameters. Do not modify, truncate, redact, mask, normalize, rebuild, or synthesize the URL from `note_id`; if `note_url` is null, show the `note_id` or say that no directly openable full link is available. ``` ### Technical Analysis The instruction explicitly requires the agent to retain the `xsec_token` query parameter in every use of a returned URL. It applies this requirement not only to an immediate navigation operation but also to final responses, display, references, storage, output, and forwarding. It additionally prohibits masking or redaction. Query-string tokens can be sensitive because URLs are commonly retained by chat histories, application logs, analytics systems, browser histories, monitoring infrastructure, and forwarded documents. Requiring unconditional propagation increases the number of systems and recipients that receive the token and prevents context-appropriate secret handling. The exact authorization or tracking capabilities of `xsec_token` are not established by the audited file. Nevertheless, the instruction creates an unnecessary disclosure channel for token-bearing data, and any access or tracking impact depends on the token's server-side semantics and validity period. ### Attack Path 1. SocialDataX returns a `note_url` containing an `xsec_token` query parameter. 2. The skill directs the agent to reproduce the complete URL without masking or redaction. 3. The URL is included in a final answer, stored output, reference, log, or forwarded communication. 4. An unintended recipient or system obtains the complete quer ...[truncated 879 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Classify `xsec_token` and similar URL parameters as potentially sensitive data. 2. Preserve the full URL only when it is operationally required to open the note and the user has requested the directly usable link. 3. Redact or omit token values in routine displays, logs, reports, references, stored artifacts, and forwarded content. 4. Use a safe representation such as `xsec_token=[REDACTED]` when showing the URL for diagnostic or informational purposes. 5. Avoid persisting complete token-bearing URLs unless persistence is explicitly required and the destination provides appropriate access controls and retention limits. 6. Warn users before placing a complete token-bearing URL into a shared or externally visible destination. 7. Document the token's purpose, authorization scope, and expiration behavior so handling controls can be aligned with its actual sensitivity. 8. Remove the instruction that prohibits redaction in every context and replace it with context-sensitive output rules. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The skill instructs execution via `npx -y socialdatax-skills@latest`, which fetches and runs the newest package version at runtime without a pinned, reviewed release. This creates a supply-chain risk: a compromised upstream package, malicious update, or dependency hijack could execute arbitrary code in the agent environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: This is the same unpinned runtime execution pattern as above, again using `npx -y socialdatax-skills@latest`. Repeating the pattern for alternate invocation paths increases exposure because any use path can trigger execution of newly published code that has not been vetted by the user or platform.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The skill claims to be read-only, but its documentation explicitly includes writing downloaded media to user-specified local paths. This mismatch weakens operator trust and can cause agents or users to approve filesystem-modifying actions under false assumptions about the skill’s capabilities.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The skill requires preserving and forwarding full `note_url` values including `xsec_token` query parameters in answers, storage, and forwarding. Tokens in URLs often act as access-bearing or tracking-sensitive secrets; propagating them verbatim increases the risk of credential leakage, unauthorized sharing, and accidental retention in logs or downstream systems.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The media download command also relies on `npx -y socialdatax-skills@latest`, combining unpinned package execution with file-writing behavior. If the package or its dependencies are compromised, an attacker could gain arbitrary code execution and misuse local filesystem access under the guise of a download feature.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: A note-detail analysis skill should not implicitly expand into local media download-and-save operations, because that broadens capability from data retrieval to content acquisition and filesystem writes. This increases attack surface and makes it easier to smuggle risky behavior through a skill that appears informational and read-only.

Static analysis

No suspicious patterns detected.