Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed SocQ integration for collecting public Kwai data, with normal cautions around API-key use, billing, and an unpinned CLI fallback.
Before installing, users should understand that requests and the SocQ API key are used with SocQ-hosted tools, jobs may consume credits, and the CLI fallback currently relies on the latest @socq/cli package unless the user pins or preinstalls a vetted version.
The skill permits use of npx and installs @socq/cli without any version pinning, which creates a supply-chain risk because future package updates or a compromised release could be pulled at execution time. In an agent skill context, this is more dangerous because automated environments may execute the tool non-interactively and repeatedly, amplifying exposure to a malicious upstream package.
The command npx @socq/cli fetches and runs the latest published package by default, exposing the agent to remote code execution through a malicious or compromised npm release. Because this skill is specifically instructing automated fallback execution when MCP is unavailable, the unpinned npx path materially increases the chance of unsafe package retrieval in production workflows.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
value: "socq"
description: "Hosted SocQ Kwai data tools"
transport: "streamable_http"
url: "https://api.socq.ai/mcp?platforms=kwai"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
value: "socq"
description: "Hosted SocQ Kwai data tools"
transport: "streamable_http"
url: "https://api.socq.ai/mcp?platforms=kwai"
Detected: suspicious.exposed_secret_literal