ClawHub
Back to skill

Security audit

SocQ Apple App Store Research

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for public App Store research, but it warrants Review because it can run an unpinned external CLI package while using a SocQ API key.

Install only if you trust SocQ with the Apple App Store research inputs and your SocQ API key. Prefer a preinstalled or pinned `@socq/cli` version instead of the unpinned npx fallback, and use the documented cost checks before large paid jobs.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding
The skill declares `npx` as an allowed binary/install path without pinning a specific package version, which creates a supply-chain risk because execution may resolve to the latest published package at runtime. If the upstream package is compromised or a breaking/malicious release is published, agents using this skill could execute untrusted code.

Rp1

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding
The instruction to use `npx @socq/cli` runs an unpinned package from the registry, exposing consumers to dependency confusion or malicious upstream releases. In an agent context, this is more dangerous because the skill explicitly operationalizes external code execution as a fallback path for handling real user requests.

External Transmission

Medium
Category
Data Exfiltration
Content
value: "socq"
      description: "Hosted SocQ Apple App Store data tools"
      transport: "streamable_http"
      url: "https://api.socq.ai/mcp?platforms=apple-app-store"
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
value: "socq"
      description: "Hosted SocQ Apple App Store data tools"
      transport: "streamable_http"
      url: "https://api.socq.ai/mcp?platforms=apple-app-store"
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:32