ClawHub
Back to skill

Security audit

Dataify Bing Shopping

Security checks across malware telemetry and agentic risk

Overview

This skill performs a disclosed, read-only Bing Shopping lookup through Dataify, using a Dataify API token and sending the shopping query to Dataify.

Install this only if you are comfortable using a Dataify API token and sending your shopping searches, locale, and filter values to Dataify. Prefer a session-scoped environment variable for the token unless you intentionally want persistent shell configuration.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
97% confidence
Finding
The skill explicitly instructs the agent to read an environment variable for authentication and perform live network calls, but the file shows no declared permissions for those capabilities. That mismatch weakens transparency and policy enforcement because users and platforms may not realize the skill can access secrets and external services.

Missing User Warnings

Medium
Confidence
80% confidence
Finding
The script sends user-supplied shopping queries and optional locale/filter fields to a third-party API without an in-band privacy notice or consent mechanism. In an agent skill context, users may reasonably assume local parsing only, so silent transmission can expose sensitive shopping intent, regional preferences, or copied filter strings to an external service.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.