ClawHub
Back to skill

Security audit

SocQ Twitch Research

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed SocQ integration for public Twitch research, with expected API and CLI use and no hidden persistence or unrelated data access.

Install this only if you are comfortable using SocQ for Twitch research and sending SocQ-authenticated requests to its hosted service. In sensitive environments, prefer a reviewed or pinned socq CLI installation over running the latest package through npx, and use SocQ API key controls such as credit limits, rate limits, and IP allowlists where available.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The skill tells the agent to use `npx @socq/cli` without pinning a specific version, which can cause execution of whatever package version is current at runtime. That creates a supply-chain risk: a malicious or compromised upstream release could execute attacker-controlled code in the agent environment and potentially access secrets such as `SOCQ_API_KEY`.

External Transmission

Medium
Category
Data Exfiltration
Content
value: "socq"
      description: "Hosted SocQ Twitch data tools"
      transport: "streamable_http"
      url: "https://api.socq.ai/mcp?platforms=twitch"
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
value: "socq"
      description: "Hosted SocQ Twitch data tools"
      transport: "streamable_http"
      url: "https://api.socq.ai/mcp?platforms=twitch"
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:32