ClawHub
Back to skill

Security audit

小红书评论分析与需求挖掘

Security checks for vulnerabilities and agentic risk

Overview

The skill provides a coherent, read-only comment-analysis workflow, with ordinary third-party service and software dependency risks.

Send only links, IDs, or share text you are comfortable providing to SocialDataX. Store the API key securely and set page or item limits to control credit use. Prefer a reviewed, fixed CLI version. The scanner's reference gaps were investigated, but the external npm implementation remains outside this artifact review.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

The command uses socialdatax-skills@latest, which selects a mutable release rather than a reviewed, fixed version, and npx -y suppresses installation confirmation. A compromised future package release could execute code with the agent process's permissions and access its API key or accessible files; the skill's read-only business purpose does not constrain package execution.

Content

No source excerpt is available for this finding.

The workflow sends user-provided note identifiers, URLs, or share text to SocialDataX without an explicit third-party data disclosure.

Medium
Category
Output Handling
Confidence
92% confidence
Finding

The direct CLI workflow instructs the agent to submit user-provided note IDs or URLs/share text through SocialDataX. Although the skill names the provider and describes its read-only behavior, it does not warn that these inputs leave the user's environment and are processed by a third-party service; read-only access does not eliminate this privacy implication.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

This URL-based invocation also executes socialdatax-skills@latest without fixing the package version. If the published release is compromised, running this otherwise legitimate comment-retrieval workflow could execute attacker-controlled code and expose credentials or local data.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

The reply-retrieval command repeats the mutable @latest package execution pattern. This creates the same supply-chain exposure as the other two commands, rather than a separate attack mechanism; a malicious release would run with the agent's available permissions despite the documented read-only API operations.

Content

No source excerpt is available for this finding.