Dataify Bing Search

• Outcome: Review
• Latest audit: Jul 16, 2026 · 8:45 PM UTC
• Version: 1.2.0

Overview

The skill mostly does what it says, but its debug URL override can send the user's Dataify API token to an arbitrary endpoint.

Review before installing. Use the skill only with the fixed Dataify endpoint, avoid `--url` unless you fully trust the destination, and do not provide precise location or coordinates unless needed. Prefer a temporary token environment variable over permanently writing the token into shell profile files.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (6)

Tainted flow: 'request' from os.getenv (line 538, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

request = urllib.request.Request(url, data=data, headers=headers, method="POST")
    try:
        with urllib.request.urlopen(request, timeout=timeout) as response:
            raw = response.read()
            text = raw.decode(response.headers.get_content_charset() or "utf-8", errors="replace")
            return 200 <= response.status < 300, text

• Confidence: 95% confidence
• Finding: The script builds a network request using a caller-controlled URL from --url and includes the Authorization bearer token in the request headers. Because urlopen() will send that request to the supplied destination, an attacker can redirect the token and all query/location data to an arbitrary server, causing credential exfiltration and data leakage.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill requires access to environment variables and makes live network requests, yet no permissions are declared. This creates a trust and review gap: operators and users cannot accurately assess that the skill will read secrets from the environment and contact external services before enabling it. In this context, the undeclared env access is especially sensitive because it reads an API token and can transmit user-derived content off-box.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: A Bing search skill should not need an unrestricted endpoint override, yet resolve_url() accepts any caller-supplied URL. In this context that materially increases danger because the skill also attaches an API bearer token and forwards user search inputs, including optional location and coordinates, to the chosen destination.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: In the main execution path, the script resolves a token, resolves a potentially caller-controlled URL, and then calls the API with the Authorization header intact. This creates a practical token exfiltration path and is especially dangerous in an agent skill because higher-level tooling may pass user-influenced arguments without noticing the credential leak.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The invocation text 'Use when a user ask run a Bing web search' is broad enough to match ordinary conversation and may cause the skill to trigger when the user did not intend an external web/API action. That increases the chance of unexpected network calls, token use, and disclosure of user prompts to a third-party service. The surrounding skill behavior makes this more dangerous because it is explicitly designed to pass the whole user request to a script and return raw API output.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The script transmits parsed search text and optional location, latitude, and longitude to an external API without any explicit disclosure or consent mechanism in the execution path. While this is core functionality for a search skill, the optional geolocation fields make the privacy impact more significant if users are unaware of what is sent off-box.

VirusTotal

62/62 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical

• Code: suspicious.secret_argv_exposure
• Location: SKILL.zh-CN.md:36