ClawHub
Back to skill

Security audit

小红书热榜选题分析

Security checks for vulnerabilities and agentic risk

Overview

The skill coherently supports read-only topic research, with ordinary third-party privacy and package-update risks.

Search terms go to SocialDataX and calls may use paid credits, so avoid confidential inputs and set sensible result limits. Keep the API key in a secret store or an untracked local configuration. Prefer an exact reviewed CLI version; the external package implementation was not included in this review.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium
Category
MCP Rug Pull
Confidence
99% confidence
Finding

The command executes socialdatax-skills@latest through npx -y, allowing a changing package release to run without an installation confirmation. A compromised release could execute code with the agent's permissions and access its API key or other accessible data; the skill's read-only description does not constrain package execution. This is a CLI supply-chain risk, rather than an unpinned MCP server specifically.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium
Category
MCP Rug Pull
Confidence
99% confidence
Finding

The search command independently uses npx -y socialdatax-skills@latest, exposing execution to an unreviewed future package version. A malicious release could access the runtime API key, search terms, and other resources available to the agent, regardless of the intended read-only search operation. This repeats the same supply-chain weakness as the hot-search command.

Content

No source excerpt is available for this finding.

The search workflow transmits user-selected keywords to a third-party service without a privacy disclosure.

Medium
Category
Output Handling
Confidence
88% confidence
Finding

The skill instructs the agent to send user-selected topics, product directions, niches, or keywords through SocialDataX search calls. Although the service and API authentication are documented, the skill does not warn that these inputs leave the user's environment; the read-only safety statement does not address that privacy impact.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

md
- `--pretty`: output formatting only.
- `--source-client socialdatax-skills --source-platform clawhub --source-skill xhs-hot-topic-selection`: usage attribution for this Agent Skill; keep these values unchanged when running examples from this Skill.

Use `xhs hot-search` for the current Xiaohongshu / XHS / RedNote search hot list. Do not ask the user for `--keyword` for this command.

## Safety Boundary

MCP server referenced without pinned version: 'npx availability'.

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.