小红书数据分析 SocialDataX 笔记搜索

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:19 AM UTC
• Version: 0.1.18

Overview

The skill is a coherent read-only XHS search helper, but it runs a mutable npm package and requires broad propagation of token-bearing URLs.

Review before installing. Use only in a constrained environment with the required SocialDataX API key, prefer a pinned reviewed package version, avoid exposing unrelated environment variables, and treat xsec_token URLs as sensitive unless the user specifically needs a working link.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:26
• Finding: Unpinned npm Package Is Downloaded and Executed at Runtime## Vulnerability Details **File Location**: `SKILL.md`, lines 6 and 26-33 **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: High ### Vulnerable Code ```yaml metadata: {"openclaw":{"requires":{"env":["SOCIALDATAX_API_KEY"],"bins":["node","npm"]},"primaryEnv":"SOCIALDATAX_API_KEY","install":[{"kind":"node","package":"socialdatax-skills","bins":[]}],"emoji":"📌","homepage":"https://socialdatax.com/ai?from=clawhub"}} ``` ```bash npx -y socialdatax-skills@latest xhs search \ --keyword "<keyword>" --pretty --source-client socialdatax-skills \ --source-platform clawhub --source-skill socialdatax-xhs-search npx -y socialdatax-skills@latest xhs search \ --keyword "<keyword>" --pages 3 --pretty --source-client socialdatax-skills \ --source-platform clawhub --source-skill socialdatax-xhs-search ``` ### Technical Analysis The documented commands use `npx -y socialdatax-skills@latest`, causing npm to retrieve and immediately execute the version currently associated with the mutable `latest` tag. The `-y` option suppresses the normal installation confirmation. No exact version, lockfile, integrity hash, or package provenance requirement is specified. Consequently, the code that runs can change after the Skill has been reviewed. A compromised publisher account, npm package, release pipeline, or future package version could introduce arbitrary executable behavior without requiring any modification to `SKILL.md`. This network retrieval is necessary in some form for the declared API-backed search functionality, but downloading and executing a mutable package release is not the minimum-risk mechanism for providing it. ### Attack Path 1. An attacker compromises the `socialdatax-skills` npm publisher account, release process, or package distribution channel, or publishes a malicious future release through another supply-chain failure. 2. The malicious release is assigned the npm ...[truncated 1096 chars]
• Remediation: ## Remediation Suggestions 1. Replace `socialdatax-skills@latest` with an exact, reviewed package version, such as `socialdatax-skills@X.Y.Z`. 2. Use a lockfile and verified npm integrity metadata so the resolved artifact cannot change silently. 3. Remove `-y` where practical and require explicit authorization before the first dependency installation. 4. Prefer installing the reviewed dependency during controlled Skill deployment rather than downloading executable code on every invocation. 5. Verify package provenance through npm provenance attestations, signed releases, and a restricted trusted registry. 6. Run the CLI in a sandbox with access only to the required API key, network destination, and working data. 7. Prevent the child process from inheriting unrelated environment variables and filesystem permissions. 8. Establish a dependency review and update process so package upgrades are audited before the pinned version changes.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:68
• Finding: Mandatory Propagation of Token-Bearing URLs Exposes Sensitive Query Parameters## Vulnerability Details **File Location**: `SKILL.md`, line 68 **Vulnerability Type**: Unsafe handling and disclosure of token-bearing URLs **Risk Level**: Medium ### Vulnerable Code ```text For XHS search results, in every use of a returned `note_url`, such as final answers, display, references, storage, output, or forwarding, preserve it exactly as the full URL, including `xsec_token` query parameters. Do not modify, truncate, redact, mask, normalize, rebuild, or synthesize the URL from `note_id`. ``` ### Technical Analysis The instruction requires the Agent to preserve and disclose the `xsec_token` query parameter in every use of a returned URL. It explicitly applies this requirement to final answers, display, references, storage, output, and forwarding, while prohibiting redaction or masking. Query-string tokens may function as access, validation, tracking, or correlation credentials. The audited file does not establish that `xsec_token` values are non-sensitive, non-replayable, audience-independent, or safe for indefinite storage. Requiring universal propagation therefore violates data minimization and prevents context-sensitive secret handling. Returning a complete URL may be necessary when a user explicitly requests a functional link. It is not necessary to preserve the token in unrelated logs, reports, stored artifacts, analytics, or forwarding contexts. ### Attack Path 1. The SocialDataX response contains a `note_url` with an `xsec_token` query parameter. 2. The Agent follows the Skill instruction and copies the complete URL into a response, log, report, stored artifact, or forwarded message. 3. The destination is retained, observed, or shared with a person or service that was not intended to receive the token. 4. If the token is replayable or carries access or correlation semantics, the recipient can use it until it expires or is invalidated. 5. Even if it does not grant direct access, the exposed value may en ...[truncated 680 chars]
• Remediation: ## Remediation Suggestions 1. Treat `xsec_token` and all unknown query-string tokens as sensitive by default. 2. Preserve the complete tokenized URL only when required to satisfy an explicit user request for a functional link. 3. Redact or remove the token from logs, diagnostics, reports, analytics, persistent storage, and forwarded content unless each destination requires it. 4. Add audience and destination checks before disclosing tokenized URLs. 5. Document the token's purpose, permissions, expiration period, replay behavior, and revocation process. 6. Prefer short-lived and audience-bound tokens where the upstream platform supports them. 7. Provide a safe display form that omits sensitive query parameters while retaining the full URL only in a protected execution context. 8. Ensure monitoring and error-reporting systems scrub sensitive URL parameters automatically.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: The skill instructs execution of `npx -y socialdatax-skills@latest`, which fetches and runs the newest package version at runtime rather than a reviewed, fixed version. This creates a supply-chain risk: if the package is compromised or a breaking/malicious release is published, agents may execute attacker-controlled code with the user's environment and API key access.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: This second CLI example repeats the same unsafe pattern by invoking `npx -y socialdatax-skills@latest`, causing unpinned remote code execution during normal skill use. Because the skill explicitly prefers the direct CLI path, this increases the likelihood that agents will run dynamically fetched code in production workflows.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly instructs agents to preserve and forward full `note_url` values including `xsec_token` query parameters in final answers, storage, and forwarding. If those parameters are access-bearing, session-linked, or anti-abuse tokens, reproducing them broadly can leak sensitive tokens into logs, downstream systems, user-visible outputs, or third parties, expanding unauthorized access and traceability risk.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Static analysis

No suspicious patterns detected.