Dataify Bing News

• Outcome: Review
• Latest audit: Sep 1, 2026 · 9:32 AM UTC
• Version: 1.3.0

Overview

This is a coherent Dataify-backed Bing News search skill, but its credential handling is broader than the instructions disclose.

Review this skill before installing if you handle sensitive credentials. It should only be used with a Dataify API token configured through an environment variable, and users should not paste tokens into chat or prompts. The network destination is Dataify's scraper API, and normal search queries will be sent there.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill instructs the agent to read an environment variable and make outbound network calls, yet no permissions are declared. That creates a trust and review gap: operators may enable the skill without realizing it can access secrets and contact third-party services, increasing the risk of unintended data exposure or policy bypass.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill is presented as a Bing News search helper, but the described behavior includes token extraction/handling and use of a third-party Dataify API rather than Bing directly. This mismatch can mislead users and reviewers about where data is sent and what sensitive material may be processed, which is especially risky when API credentials and user queries may be transmitted off-platform.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The skill extracts API tokens from free-form natural-language prompts, which encourages users or upstream agents to place secrets in conversational input. In an agent setting, prompt text is often logged, replayed, summarized, or exposed to other components, so treating prompt content as a secret source increases the risk of credential leakage and unintended reuse.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: After resolving a token, the code writes it back into `os.environ`, causing prompt-derived or CLI-supplied credentials to persist in mutable process-wide state. In multi-component or long-lived agent runtimes, that increases the chance that unrelated code, child processes, crash reports, or debug tooling can access the secret beyond the immediate request scope.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

token = token.strip()
    if not token.lower().startswith("bearer "):
        token = f"Bearer {token}"
    os.environ["DATAIFY_API_TOKEN"] = token
    return token

• Confidence: 95% confidence
• Finding: Writing the API token into `os.environ["DATAIFY_API_TOKEN"]` effectively harvests and retains sensitive data in globally accessible environment state for the process. While the code is not stealing external secrets, it broadens secret exposure inside the runtime and can enable accidental disclosure to other libraries or subprocesses.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.