Security audit
Security checks for vulnerabilities and agentic risk
The skill’s documented behavior fits read-only Zhihu research through SocialDataX, with expected privacy, credential, and software-installation risks.
SocialDataX receives the research inputs you submit, and requests may consume paid credits. Avoid confidential search terms or share text, and keep the API key out of chat and version control. Prefer a reviewed, fixed CLI version with limited access to local files and unrelated secrets. This review covers the bundled instructions; downloaded CLI code and future releases remain unverified.
The hot-list command executes socialdatax-skills@latest, a mutable npm reference, with automatic installation approval through npx -y. A compromised or malicious future release could execute with the agent's permissions and access its API key and other accessible resources; the documented read-only API scope does not constrain package execution.
The search command downloads and executes a mutable @latest package rather than a reviewed fixed release. If the package's release channel is compromised, execution can expose the API key and local resources regardless of the intended read-only search operation.
The skill instructs the agent to execute searches and lookups using user-provided inputs through the SocialDataX service, rather than merely listing available tools. The safety section describes the skill as read-only and explains credential handling, but does not warn that these inputs are transmitted to a third-party provider; read-only access does not eliminate that privacy impact.
The paginated search example repeats the automatic execution of socialdatax-skills@latest. This creates the same supply-chain exposure as the single-page command: a malicious release could run with the agent's permissions and read available credentials.
The detail command uses npx -y with @latest, allowing the executed package version to change without review. A compromised release could steal the environment-provided API key or access local files, even though the requested operation only retrieves content.
The comments command automatically executes the release currently selected by the mutable latest tag. Compromise of that release path could lead to arbitrary code execution with the agent's existing permissions and access to its credentials.
The replies command executes an unpinned @latest npm release with automatic installation approval. Its read-only business function does not prevent a malicious package release from accessing the API key or performing other actions permitted to the agent process.
The creator-profile command relies on the mutable socialdatax-skills@latest reference. A malicious or compromised future release could execute with access to the agent's environment and files; the provider branding and read-only description do not establish package integrity.
The creator-posts command automatically installs and executes whichever release @latest resolves to. If that release is compromised, it could expose credentials or modify accessible resources despite the intended data-retrieval-only workflow.
The all-posts example repeats the same unpinned package execution through npx -y. This is another instance of the shared supply-chain weakness, not a separate exploit mechanism; a compromised release could access the runtime's API key and other resources.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
