Security audit
Security checks for vulnerabilities and agentic risk
This skill provides read-only YouTube research through SocialDataX, with expected privacy, API usage, and downloaded-software risks.
Search terms, YouTube URLs, and request parameters go to SocialDataX, so avoid confidential inputs and monitor API credits, especially with --all. Keep the API key in secret storage and out of chat and version control. Prefer a reviewed, pinned CLI version with limited local access. This review covers the complete bundled skill text; the downloaded CLI and hosted service remain outside the inspected artifact.
The skill instructs the agent to run SocialDataX searches and lookups using user-provided keywords and URLs, but never explicitly warns that those inputs are transmitted to SocialDataX. Naming the API provider and describing the skill as read-only do not explain this privacy-relevant data flow.
The search command runs socialdatax-skills@latest, a mutable package reference, with automatic installation confirmation. A compromised future release could execute with the agent's permissions and access its API key or other accessible data; the documented read-only API behavior does not constrain package execution.
The paginated search example also executes the mutable socialdatax-skills@latest package using npx -y. If the published release or its dependency chain is compromised, ordinary research requests could trigger malicious code in the credential-bearing agent environment.
The video-detail command downloads and executes a package selected by the moving @latest tag rather than a reviewed version. Although this is a direct CLI rather than an MCP server, the underlying supply-chain exposure is real and could allow credential theft or unauthorized local actions following a malicious release.
The comments command uses npx -y with socialdatax-skills@latest, allowing the executable package to change without a corresponding review of this skill. A compromised release could operate with the agent process's privileges, regardless of the command's intended read-only purpose.
The replies example executes an unpinned latest release with automatic installation confirmation. Its use inside an agent environment containing an API key increases the consequences of a package or dependency compromise, even though no compromise is demonstrated here.
The channel-info command trusts the moving socialdatax-skills@latest release at execution time. If that release becomes malicious, npx can execute attacker-controlled code with access to the agent's environment and permitted filesystem resources.
The channel-posts example uses a mutable @latest package reference and npx -y rather than a controlled installation. This creates a supply-chain execution risk: a malicious update could access credentials or perform actions unrelated to listing YouTube videos.
The all-posts variant repeats the same unpinned npx execution pattern as the other CLI examples. The --all option is not the security issue; the issue is that a compromised latest package could execute arbitrary code in the agent's environment.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
