ClawHub
Back to skill

Security audit

SocQ Truth Social Research

Security checks for vulnerabilities and agentic risk

Overview

This skill is a clearly disclosed SocQ integration for collecting public Truth Social data, with ordinary API-key and hosted-service risks users should understand.

Install this only if you intend to use SocQ for public Truth Social research and are comfortable giving the SocQ service an API key plus the public account, post URL, filter, and pagination inputs you ask it to process. Prefer a preinstalled or pinned @socq/cli version over npx when possible, and use the documented credit limits and confirmation steps for larger paid runs.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding
The skill instructs users to run `npx @socq/cli` without pinning a specific version. `npx` can download and execute the latest published package at runtime, which creates a supply-chain risk: a compromised upstream package, malicious update, or typosquatting scenario could lead to arbitrary code execution in the agent environment. In this skill context, that risk is meaningful because the tool is intended to run with access to `SOCQ_API_KEY`, so a malicious package could exfiltrate credentials or tamper with research output.

External Transmission

Medium
Category
Data Exfiltration
Content
value: "socq"
      description: "Hosted SocQ Truth Social data tools"
      transport: "streamable_http"
      url: "https://api.socq.ai/mcp?platforms=truth-social"
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
value: "socq"
      description: "Hosted SocQ Truth Social data tools"
      transport: "streamable_http"
      url: "https://api.socq.ai/mcp?platforms=truth-social"
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:32