Security audit
Security checks for vulnerabilities and agentic risk
The skill coherently supports Xiaohongshu research through SocialDataX, with ordinary privacy and external-package risks.
Use it for intended Xiaohongshu searches and avoid confidential search terms. Requests use SocialDataX and may consume paid credits. Keep the API key in a local secret store and out of version control. Prefer a reviewed, pinned CLI release with limited permissions: the external package code was not verified, and latest can change after this review.
The instruction lists topic discovery, content planning, competitor research, market observation, and trend scanning as standalone activation conditions. These common requests can concern unrelated platforms, so the skill may activate even when Xiaohongshu research is not intended.
The command executes socialdatax-skills@latest, so its executable contents can change without a skill update or review; -y also suppresses the installation confirmation. A compromised package release could execute with the agent's permissions and access its environment, including the API key. This is a direct CLI supply-chain issue, despite the finding labeling it an MCP server issue.
The workflow instructs the agent to execute SocialDataX searches using keywords derived from the user's actual intent. Although the safety section discusses credential handling and read-only behavior, it does not warn that these keywords leave the execution environment and are submitted to SocialDataX, which matters when research topics contain confidential information.
The second example repeats execution of the mutable socialdatax-skills@latest release with automatic installation approval. It exposes the same agent permissions and available credentials to a potentially compromised future release; adding pagination does not change that risk. This is another occurrence of the same root cause, not an independent attack mechanism.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
