Dataify Google Maps Reviews

Security checks across malware telemetry and agentic risk

Overview

This appears to be a normal Dataify API integration that uses a Dataify token and network calls, with a documentation/permission transparency gap rather than evidence of abuse.

Before installing, confirm you intend to connect this skill to Dataify, provide only a Dataify-specific token with the minimum needed access, and be aware that prompts or inputs sent through the skill may be transmitted to Dataify. The publisher should improve metadata by declaring the environment variable and Dataify network endpoint explicitly.

SkillSpector

By NVIDIA

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill instructs the agent to access environment variables for `DATAIFY_API_TOKEN` and make outbound network requests to a third-party API, but the skill declares no corresponding permissions. This creates a permission-transparency gap: a reviewer or platform policy engine may not realize the skill can read secrets and transmit data externally, increasing the risk of unintended secret use or unauthorized exfiltration.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal