dataify-crunchbase-company-by-url

• Outcome: Pass
• Latest audit: Jun 8, 2026 at 2:31 AM UTC
• Version:
  1.1.0

Overview

This skill is a straightforward Dataify curl-request builder, but users should handle the Dataify API token carefully.

Install only if you intend to use Dataify for Crunchbase scraping. Prefer a session-scoped token or a credential manager where practical, do not commit shell profiles containing DATAIFY_API_TOKEN, and avoid sharing generated curl commands because the helper may include the actual bearer token.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill instructs users to persist an API token in shell profile files and environment settings without warning about credential exposure, shell history leakage, local multi-user access, or accidental inclusion in dotfile backups/repos. While not overtly malicious, this normalizes long-lived secret storage in places that are commonly copied, synced, or inspected, increasing the chance of token compromise.

VirusTotal

65/65 vendors flagged this skill as clean.