Security audit
Security checks for vulnerabilities and agentic risk
The skill supports read-only Xiaohongshu research through SocialDataX, with ordinary API privacy and external software risks.
Use a dedicated SocialDataX key stored through your client's secret settings, and submit only inputs you are comfortable sending to that service. Prefer a reviewed, fixed CLI version with limited local access. API calls may consume credits. The only bundled file was fully inspected; the scanner's reference gaps were investigated, but external CLI code and hosted-service behavior remain unverified.
The hot-search command executes socialdatax-skills@latest with automatic installation approval, rather than an immutable reviewed version. A compromised package release could execute with the agent's permissions and read its API key or other accessible data; the documented read-only API scope does not constrain local package execution.
The search command automatically executes the mutable @latest package version. A malicious or compromised future release could access credentials and local resources independently of the intended search operation.
The skill instructs the agent to run SocialDataX searches and detail lookups using user-supplied keywords and URLs or share text. Although it identifies the API provider and explains credential handling, it never warns users that these inputs are transmitted to a third-party service; the read-only safety statement does not address this privacy impact.
The paginated search example uses @latest and -y, allowing execution of a package version that can change without review. Package compromise could expose the API key or permit arbitrary actions under the agent's execution identity.
The note-detail command fetches and executes a mutable @latest dependency without a version review gate. A compromised release could access the agent's environment and files despite the requested operation being read-only.
The URL-based detail command automatically runs whichever package release @latest resolves to. A compromised release could steal credentials or access local resources, and the skill's read-only description provides no execution sandbox.
The comments command uses automatic execution of the unpinned @latest package. Compromise of that dependency could lead to code execution with access to the API key and whatever resources the agent can access.
The expanded-comments example executes a mutable package release using npx -y. If that release is compromised, its code can act beyond the intended read-only API requests and expose credentials or local data.
The URL-based comments command relies on @latest rather than a fixed reviewed artifact. A malicious package update could execute with the agent's permissions and access its API key or other available data.
The sub-comments example automatically executes an unpinned package release. A compromised release could perform arbitrary operations under the agent's identity rather than merely retrieving replies.
The user-info command uses the mutable @latest dependency with automatic installation approval. Package compromise could expose secrets or local resources even though the intended API action only reads a creator profile.
The profile-URL lookup automatically executes whichever release @latest selects. A compromised release could read the API key and perform actions using the agent's available privileges.
The creator-posts command executes a mutable external package version without a review gate. A malicious update could access credentials and files beyond the intended read-only data retrieval.
The all-posts example uses npx -y with @latest, allowing new package code to execute without explicit version approval. A supply-chain compromise could expose the runtime API key or enable arbitrary actions with agent privileges.
The profile-URL posts command runs an unpinned @latest release with automatic approval. A compromised dependency would execute locally with access determined by the agent environment, not by the documented read-only API boundary.
The search-suggestions command automatically executes a mutable @latest release. A malicious package update could access credentials or perform local actions unrelated to the suggestion request.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
