Most static detections are Markdown, readable Chinese prose, or scoped credential configuration rather than malicious behavior. The command block executes an unpinned npm package, creating supply-chain exposure; the polling instructions also lack a deadline. No evidence found of credential exfiltration or prompt injection in the supplied files; external package and service implementations were not reviewed.
The instructions require continued polling whenever data.is_terminal is not true. Stop conditions exclude request limits and deadlines, allowing stalled jobs to consume resources indefinitely.
The prose explicitly limits stopping to terminal status, unavailable tools, or user cancellation. Polling delays reduce frequency but do not bound total runtime.
The fenced block executes npx -y socialdatax-skills@latest, automatically accepting an unpinned package. A compromised release could execute with local permissions and inherited credentials.
Most static alerts are Markdown formatting, documented API authentication, platform identifiers, or readable Chinese text rather than malicious behavior. The command examples execute an unpinned npm package with access to the API credential. Polling also lacks a time or attempt limit; no evidence found of prompt injection or credential exfiltration in the reviewed files.
The workflow requires continued polling for every nonterminal response and permits stopping only on completion, tool failure, or user request. A stalled service can therefore consume agent time and API requests indefinitely.
The explicit stop conditions omit elapsed-time and attempt limits. Waiting between queries reduces request frequency but does not bound total resource use.
Although the backticks are a Markdown fence, its commands use npx -y socialdatax-skills@latest, automatically downloading and executing an unpinned package. That package inherits the environment, including SOCIALDATAX_API_KEY, creating supply-chain exposure.