小红书数据助手 SocialDataX

• Outcome: Review
• Latest audit: Sep 18, 2026 · 6:58 AM UTC
• Version: 0.1.21

Overview

The skill is mostly coherent for read-only Xiaohongshu data lookup, but it asks agents to run an unpinned npm package at runtime with an API key and to preserve tokenized URLs broadly.

Review before installing. Use only if you are comfortable giving the SocialDataX CLI access to SOCIALDATAX_API_KEY, and prefer a pinned reviewed package version instead of @latest. Treat returned XHS URLs containing xsec_token as sensitive and avoid forwarding or storing them unless needed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (16)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: The skill instructs users to execute `npx -y socialdatax-skills@latest`, which fetches and runs the newest package version at execution time rather than a reviewed, fixed version. This creates a supply-chain risk: a compromised publisher account, malicious dependency update, or unexpected breaking change could cause arbitrary code execution in the user's environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: This command again relies on `npx ... @latest`, causing code from the npm registry to be downloaded and executed on demand with no version pinning. If the upstream package or one of its dependencies is tampered with, the skill becomes a vehicle for remote code execution and credential theft, including exposure of `SOCIALDATAX_API_KEY`.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: Using `npx -y socialdatax-skills@latest` here introduces the same unpinned supply-chain execution risk. Because `npx` executes fetched package code directly, any malicious or compromised release could run with the invoking user's privileges.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: The command at this line executes an unpinned npm package via `npx`, making behavior dependent on whatever version is current when the skill runs. That exposes users to package compromise, dependency hijacking, or malicious update scenarios that can lead to arbitrary code execution.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: This example also executes `socialdatax-skills@latest`, which is effectively trusting future unpublished code changes from the npm ecosystem. In a skill that expects an API key in the environment, that trust boundary is especially sensitive because malicious code could read and exfiltrate secrets.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: The skill's direct CLI guidance at this line uses `npx @latest`, which enables execution of changing third-party code without integrity guarantees. That is a classic software supply-chain weakness and is more serious here because users may execute these commands verbatim.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: This occurrence repeats the same unsafe pattern of running the latest npm package version on demand. If an attacker compromises the package or its dependencies, the user's system and environment variables could be accessed when the command is invoked.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: The command fetches and executes an unpinned package from npm, creating an avoidable supply-chain attack surface. Because the skill frames these as preferred commands, users are likely to run them directly, increasing practical exploitability.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: This line continues the pattern of dynamic execution of `socialdatax-skills@latest`. The risk is not theoretical: a malicious update could perform arbitrary local actions, alter outputs, or steal the configured API key before returning expected data.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: Executing `@latest` via `npx` means the command's trustworthiness depends on the state of the public registry at runtime. In a security review context, that is a real vulnerability because it undermines reproducibility and allows supply-chain compromise to become code execution.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: This example has the same issue: `npx` is used to run whatever the latest package release is at that moment. That can lead to arbitrary code execution or data exfiltration if the package, maintainer account, or dependency chain is compromised.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: The use of `socialdatax-skills@latest` here exposes the same npm supply-chain execution risk as the earlier commands. Since the skill expects secret-bearing environment variables, a malicious package revision could harvest credentials or manipulate returned data.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: This command example is vulnerable because it executes unreviewed future code from npm via `@latest`. That is especially risky in agent or automation contexts where commands may be run non-interactively and inherit sensitive environment variables.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: This is another true positive for unpinned package execution through `npx @latest`. The skill context does not neutralize the issue; instead, it increases exposure because the instructions are repeated many times and positioned as authoritative examples.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly requires preserving and forwarding full `note_url` values including `xsec_token` parameters in all outputs. Query tokens often function as access-bearing, tracking, or anti-abuse parameters; mandating their unredacted disclosure can leak sensitive URLs to logs, downstream tools, users who do not need them, or third-party systems.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Static analysis

No suspicious patterns detected.