Security checks across malware telemetry and agentic risk
The skill appears purpose-aligned, but it handles a Dataify API token in ways that can expose it in saved shell files and generated command output.
Review this skill before installing if you care about API-token hygiene. Prefer setting DATAIFY_API_TOKEN only for the current session or through a secret manager, avoid committing shell profiles that contain tokens, and modify or avoid the helper output so it prints Authorization: Bearer $DATAIFY_API_TOKEN instead of the actual token value.
def build_curl(tool: Dict[str, Any], spider_parameters_json: str) -> str:
token = os.environ.get("DATAIFY_API_TOKEN", "").strip()
if not token:
raise SystemExit(
"DATAIFY_API_TOKEN is not set. Sign in at https://www.dataify.com/ to obtain it, then export it as an environment variable."VirusTotal findings are pending for this skill version.