Security audit

SocQ Social and SEO Research

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent SocQ integration for public-data research, with expected external API use and billing, though users should manage cost, privacy, and unpinned npx fallback risk.

Install this only if you are comfortable sending the requested search terms, URLs, usernames, platform IDs, and other public-data targets to SocQ. Use a scoped SOCQ_API_KEY with credit/rate limits where possible, confirm expected spend before large or multi-platform jobs, and prefer pinned or preinstalled SocQ CLI/MCP packages instead of resolving npx packages at runtime.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Ae1

High

Category: analysis-evasion
Content: - Search the live Capability Registry first. Read [catalog.md](references/catalog.md) when tool discovery is unavailable.
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The fallback instruction `npx @socq/cli` is also unpinned, so it carries the same runtime package-fetching and arbitrary code execution risk as other unversioned `npx` usage. In this skill context, that risk is amplified because the tool is expected to handle API credentials and make external requests.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The fallback instruction `npx @socq/cli` is also unpinned, so it carries the same runtime package-fetching and arbitrary code execution risk as other unversioned `npx` usage. In this skill context, that risk is amplified because the tool is expected to handle API credentials and make external requests.

External Transmission

Medium

Category: Data Exfiltration
Content: value: "socq" description: "Hosted SocQ social and SEO data tools" transport: "streamable_http" url: "https://api.socq.ai/mcp"
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

Category: Data Exfiltration
Content: value: "socq" description: "Hosted SocQ social and SEO data tools" transport: "streamable_http" url: "https://api.socq.ai/mcp"
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The catalog encourages use of many third-party SocQ endpoints but does not warn that user-supplied queries, URLs, usernames, and similar inputs will be transmitted to an external service and may trigger per-request or per-result billing. In an agent setting, that omission can lead to unintended disclosure of sensitive user inputs and unexpected cost-incurring actions without informed consent.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The manifest describes a skill for researching public social-platform content plus SEO search data, but this catalog also advertises substantial non-social capabilities such as Amazon product data, Google Maps places/reviews, LinkedIn jobs, app-store data, and multiple ad libraries. Those capabilities materially expand the skill's apparent behavior beyond the narrower stated purpose rather than serving as an obvious implementation detail of social/SEO research.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The file documents endpoints that collect public follower/following profiles, comments, videos, transcripts, and live-room metadata from third-party social platforms, but it does not warn users that these actions gather third-party social data and may trigger privacy, consent, policy, or compliance concerns. In a research-oriented skill, this omission can cause agents or users to invoke sensitive collection capabilities without informed approval or appropriate safeguards.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The file documents multiple X endpoints that transmit user-supplied usernames, queries, URLs, and WOEIDs to the external SocQ service, but it does not warn users or calling agents that their inputs will leave the local trust boundary. This can cause unintended disclosure of sensitive investigation targets, search terms, or account lists, especially in enterprise or intelligence workflows where even the existence of a query may be sensitive.

Missing User Warnings

Low

Confidence: 85% confidence
Finding: This markdown file documents endpoints that collect public Kwai posts, profiles, and user posts, which involves accessing third-party user data. The description does not include any warning about privacy considerations, external data retrieval, or the need to ensure the user is authorized to inspect the target account/content.

Vague Triggers

Low

Confidence: 87% confidence
Finding: The instruction 'Read this file when the request targets Reddit' does not define what qualifies as targeting Reddit or provide exclusion conditions. This ambiguity could cause the skill guidance to be consulted for loosely related requests rather than only explicit Reddit data tasks.

Natural-Language Policy Violations

Low

Confidence: 90% confidence
Finding: The validated examples use Chinese queries like "旅行攻略" and "摄影" as the only shown search inputs, which implicitly steers usage toward a specific language. The file does not state that Rednote content is primarily Chinese-language nor offer language choice or opt-in, so this is a natural-language locale policy concern.

Natural-Language Policy Violations

Low

Confidence: 91% confidence
Finding: The text states that the endpoint supports US only and instructs users to omit region or set it to US. This is a natural-language locale constraint, and the file does not present it as a user-selectable option or provide an opt-in mechanism.

Natural-Language Policy Violations

Low

Confidence: 91% confidence
Finding: The documentation requires US-only usage for this endpoint and instructs users to omit region or set it to US. This enforces a specific locale in natural language without presenting a user choice or documenting an opt-in path.

Natural-Language Policy Violations

Low

Confidence: 86% confidence
Finding: The validated example for `tiktok/video-transcript` hard-codes `"language": "en"`, which can be read as prescribing a specific language/locale. The file does not indicate that language is user-selectable or explain why English is required here.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:32