ClawHub
Back to skill

Security audit

小红书选题分析

Security checks for vulnerabilities and agentic risk

Overview

The skill provides clearly scoped, read-only Xiaohongshu research through SocialDataX, with ordinary package and third-party service risks.

Use a dedicated API key through your client's secret storage, keep confidential information out of search terms, and understand SocialDataX's usage charges. Prefer a reviewed, pinned CLI version. The complete bundled skill was inspected, including the references behind partial scanner coverage; the external npm package remains outside this artifact review.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

The command uses npx -y socialdatax-skills@latest, automatically executing an unpinned npm package rather than a fixed, reviewed release. Although this is a direct CLI invocation rather than an MCP server launch, a compromised future release could execute with the agent's permissions and access its API key or other accessible data; the skill's read-only description does not constrain package execution.

Content

No source excerpt is available for this finding.

The search workflow sends user-derived research keywords to SocialDataX without a privacy warning.

Medium
Category
Output Handling
Confidence
88% confidence
Finding

The skill instructs the agent to run external searches using keywords derived from the user's actual intent (L051), but does not warn that those terms are transmitted to SocialDataX. The read-only assurances in L088 address account modifications and local browser access, not disclosure of potentially confidential research topics to a third party.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

The paginated search example repeats the same unpinned npx -y socialdatax-skills@latest execution pattern. A malicious or compromised release could run arbitrary code with the agent's privileges, independently of the intended read-only search operation; this is another occurrence of the first finding's underlying issue.

Content

No source excerpt is available for this finding.