Security audit

Dataify Bing Maps

Security checks for vulnerabilities and agentic risk

Overview

This is a read-only map search skill, but its token instructions are inconsistent and could lead users to expose a Dataify API token.

Review before installing. Use only if you are comfortable sending Bing Maps queries and any coordinates you provide to Dataify. Configure DATAIFY_API_TOKEN through a local environment variable or secure runtime secret, not by pasting it into chat and not with the --token command-line option; rotate the token if it was previously shared in chat or shell history.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/bing_maps.py:496
Finding: API Token Exposed Through Command-Line Arguments
Content: View full analysis
Vulnerability Details

File Location: scripts/bing_maps.py, lines 496 and 558
Vulnerability Type: Credential exposure through process arguments and shell history
Risk Level: Medium

Vulnerable Code

python
def resolve_token(args: argparse.Namespace) -> str: token = args.token or os.getenv("DATAIFY_API_TOKEN")

python
parser.add_argument("--token", help="API token for this run. Bearer prefix is added when missing.")

Technical Analysis

The script permits a Dataify API token to be supplied through the --token command-line option. Command-line arguments are not an appropriate secret transport mechanism because they may be:

Retained in shell history.

Visible to other local users through process inspection utilities.

Captured by process-monitoring, diagnostic, telemetry, or audit systems.

Recorded in terminal logs, automation output, or support bundles.

This option exceeds the minimum authentication mechanism necessary for the Skill because the script already supports reading DATAIFY_API_TOKEN from the environment. The token is not transmitted to an unexpected destination; it is used as the authorization credential for the documented Dataify endpoint. The vulnerability concerns local credential exposure before or during execution.

Attack Path

A user runs the script with a command such as python3 scripts/bing_maps.py --token SECRET ....

The token becomes part of the process argument list and may also be written to shell history.

Another local user, monitoring process, log collector, or diagnostics tool reads the exposed argument or history entry.

The recovered token is reused to authenticate to the Dataify API.

The attacker performs API requests under the victim's account and consumes available credits or accesses capabilities granted to that token.

Impact Assessment

Successful exploitation exposes the Dataify API token. An attacker ...[truncated 363 chars]
Remediation: View remediation
Remediation Suggestions

Remove the --token command-line option from the argument parser.

Read the token exclusively from DATAIFY_API_TOKEN or an operating-system credential store.

If interactive entry is necessary, use a non-echoing prompt such as Python's getpass.getpass() rather than command-line arguments.

Do not print the token, include it in errors, or place it in generated command examples.

Avoid unnecessarily rewriting the prefixed token into os.environ; keep it in a local variable for the lifetime of the request.

Document session-scoped environment setup and recommend rotating any token previously supplied through --token.

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.zh-CN.md:37
Finding: Localized Instructions May Cause API Token Disclosure in Chat
Content: View full analysis
Vulnerability Details

File Location: SKILL.zh-CN.md, lines 37 and 80
Vulnerability Type: Conflicting credential-handling instructions
Risk Level: Medium

Vulnerable Instruction Snippets

Faithful English rendering of line 37:

text
If no token is available, the script exits with a localized message; ask the user to enter a Dataify API token or register through the Dataify Dashboard.

Faithful English rendering of line 80:

text
If the live call fails because DATAIFY_API_TOKEN is missing, ask the user to provide the token or register through the Dataify Dashboard.

These instructions conflict with the later policy at line 102:

text
Never ask the user to paste the token into chat.

Technical Analysis

The localized Skill instructions tell the agent to ask the user to enter or provide an API token when authentication is missing. A later section prohibits asking the user to paste the token into chat, but the earlier directives remain ambiguous and directly conflict with that prohibition.

An agent may follow the earlier, task-specific instruction and solicit the credential in the active conversation. Secrets entered into chat can be exposed to conversation history, model-processing infrastructure, telemetry, exported transcripts, or other users with access to the session.

The English Skill documentation uses safer environment-variable guidance, so the localized variant introduces inconsistent security behavior depending on which documentation the agent follows.

Attack Path

The Skill attempts a live request without DATAIFY_API_TOKEN configured.

The missing-token path is triggered.

The agent follows the localized instruction to ask the user to provide or enter the token.

The user pastes the Dataify API token into the conversation.

The credential is retained or exposed through chat history, telemetry, transcript exports, or session access.

A p ...[truncated 455 chars]
Remediation: View remediation
Remediation Suggestions

Replace both instructions with an explicit prohibition against sending API tokens through chat.

Instruct users to configure DATAIFY_API_TOKEN directly in their local shell or secure runtime environment.

Show only the setup command appropriate for the detected operating system and shell.

Verify only whether the environment variable exists; never print, echo, or otherwise reveal its value.

Harmonize the English and localized Skill documentation so all variants enforce the same credential-handling policy.

After authentication is configured, continue the original request without asking the user to repeat either the query or the token.

Advise users who previously pasted a token into chat to revoke and rotate it.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Tainted flow: 'request' from os.getenv (line 523, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/bing_maps.py (reported line 525)May include surrounding context.
python
request = urllib.request.Request(DEFAULT_ENDPOINT, data=data, headers=headers, method="POST") try: with urllib.request.urlopen(request, timeout=timeout) as response: raw = response.read() text = raw.decode(response.headers.get_content_charset() or "utf-8", errors="replace") return 200 <= response.status < 300, text

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill instructs the agent to read an environment variable and make live API/network calls, but it declares no explicit tool scope or permissions boundary. This creates an authorization gap where a host may permit broader access than intended, making secret access and outbound requests implicit rather than auditable or least-privilege constrained.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The workflow parameter guidance is written in Chinese for several core fields, while the rest of the skill is in English. This creates an implicit language constraint for users or maintainers who do not read Chinese, and the file does not state that the skill is intentionally Chinese-language or provide an opt-in language choice.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.
md
## Account CTA policy - Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits. - For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat. - Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks. - After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it. - Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.zh-CN.md (reported line 101)May include surrounding context.
md
## Account CTA policy - Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits. - For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat. - Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks. - After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it. - Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.
md
- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits. - For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat. - Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks. - After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it. - Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control. - For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management. - During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.zh-CN.md (reported line 103)May include surrounding context.
md
- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits. - For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat. - Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks. - After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it. - Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control. - For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management. - During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: L010 says the skill should return the API response directly to the user without summarization, parsing, or post-processing. But L084-L086 later says the default behavior is to return streamlined results with selected fields and only return raw JSON or HTML when explicitly requested. These instructions describe materially different behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instruction says the script will exit with a prompt in Chinese when no token is available. This imposes a specific language on the user experience without offering a choice or documenting a justified locale restriction, which matches the language/locale policy violation category.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Multiple user-facing parameter descriptions and the missing-token error message are written in Chinese, while other CLI help text is in English. This creates a language policy issue because the skill effectively forces some user interactions into a specific language without opt-in or an explicitly documented region-specific scope.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This skill sends user-supplied search terms and potentially precise coordinates (cp) to a third-party service, but the code provides no user-facing disclosure or consent checkpoint at the point of transmission. In this skill context, location queries can be sensitive, so silent transmission to an external API increases privacy risk even if the request is otherwise expected behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: This markdown file documents use of an Authorization bearer token and notes that the bundled script uses the endpoint directly, but it does not include any warning about protecting the token or avoiding accidental exposure in logs or shared outputs. For markdown files, missing disclosures about privacy- or security-relevant behavior can warrant a finding when sensitive credentials are involved.
Content: No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

Category: Dangerous Code Execution
Confidence: 50% confidence
Finding: Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
Content: Scanner excerpt · scripts/bing_maps.py (reported line 417)May include surrounding context.
python
def apply_overrides(payload: dict[str, str], args: argparse.Namespace) -> dict[str, str]: for key in ["q", "json", "cp", "setlang", "first", "count"]: value = getattr(args, key, None) if value is not None: payload[key] = value

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Instruction Snippets

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Tainted flow: 'request' from os.getenv (line 523, credential/environment) → urllib.request.urlopen (network output)

Undeclared Tool Scope

Natural-Language Policy Violations

Autonomous Decision Making

Autonomous Decision Making

Autonomous Decision Making

Autonomous Decision Making

Intent-Code Divergence

Natural-Language Policy Violations

Natural-Language Policy Violations

Missing User Warnings

Missing User Warnings

Dynamic attribute access via getattr()

Static analysis