ClawHub
Back to skill

Security audit

Dataify Bing Shopping

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Bing Shopping API helper that uses a Dataify token only for confirmed search requests.

Before installing, understand that confirmed searches send your shopping query and Dataify API token to Dataify. Prefer a scoped or temporary token if available, review the parameter table before confirming, and avoid pasting tokens into shared chats or persistent shell profiles unless you intend that storage.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill instructs the agent to read an environment variable (`DATAIFY_API_TOKEN`) and make live network calls, but it does not declare those capabilities as permissions. Undeclared access to secrets and outbound network use weakens user/operator visibility and consent, and could allow token use or data exfiltration through a skill that appears less privileged than it is.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
token = token.strip()
    if not token.lower().startswith("bearer "):
        token = f"Bearer {token}"
    os.environ["DATAIFY_API_TOKEN"] = token
    return token
Confidence
76% confidence
Finding
os.environ["DATAIFY_API_TOKEN"]

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical
Code
suspicious.secret_argv_exposure
Location
SKILL.zh-CN.md:36