ClawHub
Back to skill

Security audit

SocQ Douyin Research

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent SocQ integration for public Douyin research, with normal external API and API-key use but a supply-chain caution around unpinned CLI execution.

Install this only if you trust SocQ with the Douyin queries, task metadata, and API-key-authenticated requests you send. Prefer a preinstalled or version-pinned `socq` CLI where possible, set spending limits on the SocQ API key, and approve large paid runs only after reviewing the estimated credit cost.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding
The skill tells the agent to use `npx @socq/cli` without pinning a specific version, which can pull the latest package at execution time. That creates a supply-chain risk: a compromised upstream package, malicious update, or breaking change could be executed automatically in the agent environment.

External Transmission

Medium
Category
Data Exfiltration
Content
value: "socq"
      description: "Hosted SocQ Douyin data tools"
      transport: "streamable_http"
      url: "https://api.socq.ai/mcp?platforms=douyin"
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
value: "socq"
      description: "Hosted SocQ Douyin data tools"
      transport: "streamable_http"
      url: "https://api.socq.ai/mcp?platforms=douyin"
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:32