Security audit

小红书达人合作评估

Security checks for vulnerabilities and agentic risk

Overview

The skill provides clearly scoped, paid creator-data lookups, with a routine supply-chain caveat from downloading the latest CLI version.

Queries use your SocialDataX key and consume credits; confirm candidates, endpoints and estimated charges. Prefer a reviewed, fixed CLI version and keep unrelated credentials out of its environment. This review covers the supplied skill instructions, not every future package release.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (7)

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The creator-profile command executes socialdatax-skills@latest through npx -y, automatically accepting a mutable package version rather than a reviewed release. If a future release or its dependencies are compromised, code could execute with the agent's permissions and access SOCIALDATAX_API_KEY; the skill's read-only business purpose does not constrain package execution.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The fans-profile command uses npx -y with @latest, allowing the executed package version to change without review. Although this is a direct CLI rather than an MCP server, the supply-chain risk remains: a compromised release could access the API key and other resources available to the agent.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The notes-performance command automatically executes whichever release @latest resolves to, without a stable reviewed dependency baseline. A malicious or compromised release could execute arbitrary code with the agent's privileges, despite the command's intended read-only data query.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The user-info command uses npx -y socialdatax-skills@latest, so an ordinary profile lookup can trigger execution of an unreviewed package release. Exploitation requires a malicious or compromised package or dependency, but could expose the configured API key or other agent-accessible data.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The fans-summary command resolves a mutable @latest release and uses -y to suppress the npx installation prompt. This is a supply-chain weakness rather than evidence of malicious intent: a compromised release could run with the agent's privileges and obtain SOCIALDATAX_API_KEY.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The commercial-overview command executes an automatically selected latest package release instead of a fixed, reviewed artifact. The intended read-only API operation does not prevent a compromised CLI or dependency from executing arbitrary code or stealing credentials.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The metrics-trend command uses the mutable @latest tag with automatic npx approval, making future executions dependent on newly published code. A compromised release could access credentials and files available to the agent; nothing in the supplied file establishes package-level isolation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.