ClawHub
Back to skill

Security audit

小红书趋势洞察

Security checks for vulnerabilities and agentic risk

Overview

The skill provides clearly scoped, read-only trend research through SocialDataX, with ordinary third-party service and dependency risks.

Search terms go to SocialDataX, and requests may consume paid credits. Avoid confidential query details and store the API key securely. Consider using a reviewed, fixed CLI version: the external package's runtime behavior is outside this artifact review.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium
Category
MCP Rug Pull
Confidence
99% confidence
Finding

The hot-search command executes socialdatax-skills@latest with npx -y, automatically accepting a mutable package version rather than a reviewed, fixed release. A compromised publisher account or malicious future release could execute code with the agent's permissions and access its API key and other accessible data; the skill's read-only description does not constrain package execution. Although the finding labels this an MCP server reference, the actual exposure is direct CLI execution.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y socialdatax-skills'.

Medium
Category
MCP Rug Pull
Confidence
99% confidence
Finding

The search command also uses npx -y socialdatax-skills@latest, allowing newly published package code to run without a version-specific review. If the package supply chain is compromised, execution can expose the API key, user-derived search terms, and other resources available to the agent. This is another invocation of the same underlying supply-chain weakness, not a separate MCP configuration issue.

Content

No source excerpt is available for this finding.

The search workflow sends user-derived keywords to SocialDataX without a privacy disclosure.

Medium
Category
Output Handling
Confidence
91% confidence
Finding

The skill instructs the agent to execute a SocialDataX search using a keyword, and line 54 directs it to derive that keyword from the user's actual intent. Although the file identifies the provider and describes the skill as read-only, it does not warn that user-provided topics or keywords are transmitted to a third-party service and could contain sensitive information.

Content

No source excerpt is available for this finding.