ClawHub
Back to skill

Security audit

小红书博主画像

Security checks for vulnerabilities and agentic risk

Overview

The skill fits its stated creator-profile lookup purpose, with ordinary third-party service and software-dependency risks.

Use a SocialDataX key stored through your client's secret mechanism, and submit only the profile information needed for the lookup. Calls may consume paid credits. Prefer a reviewed, fixed CLI version. This review covers the bundled instructions; the external package implementation was not verified.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium
Category
MCP Rug Pull
Confidence
99% confidence
Finding

The command uses npx -y socialdatax-skills@latest, which automatically executes a mutable package release rather than a reviewed, fixed version. Although this is a direct CLI rather than an MCP server, a compromised future release could execute code with the agent process's permissions and access its API key or other accessible data; the skill's read-only description does not constrain package execution.

Content

No source excerpt is available for this finding.

The workflow sends user-provided account identifiers or profile/share text to SocialDataX without disclosing that external data transfer.

Medium
Category
Output Handling
Confidence
94% confidence
Finding

The skill instructs the agent to execute API-backed commands with user-supplied account IDs, profile URLs, or share text. Although it documents authentication and describes the capability as read-only, it does not warn users that these inputs are transmitted to the third-party SocialDataX service; read-only access does not eliminate this privacy consideration.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium
Category
MCP Rug Pull
Confidence
99% confidence
Finding

The profile-URL command also automatically executes socialdatax-skills@latest, exposing the workflow to unreviewed package changes and supply-chain compromise. This is the same underlying issue as the first finding, not a separate attack mechanism, and malicious package code would not be limited to the advertised read-only API operation.

Content

No source excerpt is available for this finding.