Security audit

Dataify Bing Shopping

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Bing Shopping API skill, but it has avoidable API-token exposure risks users should review before installing.

Install only if you are comfortable sending shopping queries to Dataify and using a Dataify API token. Prefer a session-scoped DATAIFY_API_TOKEN or a proper secret manager; avoid putting the token in shell startup files, Windows persistent user environment variables, command-line arguments, chat, or project files. Rotate the token if it has already been exposed through shell history or configuration files.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.zh-CN.md:21
Finding: Persistent Plaintext Storage of the Dataify API Token
Content: View full analysis
Vulnerability Details

File Location: SKILL.zh-CN.md, lines 21–48
Vulnerability Type: Plaintext credential persistence
Risk Level: Medium

Vulnerable Code

markdown
## 设置 DATAIFY_API_TOKEN 推荐使用永久环境变量，而不是只在当前终端临时设置。 Windows PowerShell，当前用户永久设置： ```powershell [Environment]::SetEnvironmentVariable("DATAIFY_API_TOKEN", "your_token_here", "User")

然后重新打开 PowerShell。如果当前会话也要立即生效，再执行：

powershell
$env:DATAIFY_API_TOKEN = "your_token_here"

macOS 或 Linux，bash 永久设置：

bash
echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.bashrc source ~/.bashrc

macOS 或 Linux，zsh 永久设置：

bash
echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.zshrc source ~/.zshrc

text
### Technical Analysis The localized instructions explicitly recommend permanent environment-variable configuration. On macOS and Linux, this writes the API token in plaintext to shell startup files such as `~/.bashrc` or `~/.zshrc`. On Windows, the token is stored as a persistent user environment variable. These storage locations are not dedicated secret stores. Shell configuration files can be read by processes operating under the same user account, copied into backups, included in diagnostic bundles, or accidentally shared. Persistent user environment variables can likewise be retrieved by other processes running in the user's security context. The guidance also conflicts with the safer account policy in the primary Skill document, which requires showing a matching session-scoped setup command first and discourages unnecessary persistent configuration. ### Attack Path 1. A user follows the localized Skill instructions. 2. The user substitutes a real Dataify API token into one of the documented commands. 3. The token is stored persistently in a shell startup file or user environment configuration. 4. Local malware, another process under the same user account, an exposed backu ...[truncated 584 chars]
Remediation: View remediation
Remediation Suggestions

Remove the recommendation to store API tokens in ~/.bashrc, ~/.zshrc, or persistent user environment variables.

Recommend session-scoped environment variables by default:

POSIX shells: export DATAIFY_API_TOKEN="..."

PowerShell: $env:DATAIFY_API_TOKEN = "..."

Command Prompt: set DATAIFY_API_TOKEN=...

If persistent storage is required, direct users to an operating-system credential manager or an approved secret-management system.

Never instruct users to paste the token into chat, source control, project files, or command examples likely to be retained.

Explain that exposed tokens should be revoked and rotated through Dataify API-key management.

Align the localized instructions with the session-scoped credential policy in SKILL.md.

T09 · Insecure Skill Coding Practices

Note

Location: scripts/bing_shopping.py:483
Finding: API Token Exposure Through Command-Line Arguments and Unnecessary Environment Mutation
Content: View full analysis
Vulnerability Details

File Location: scripts/bing_shopping.py, lines 483–493 and line 529
Vulnerability Type: Unsafe credential handling
Risk Level: Low

Vulnerable Code

python
def resolve_token(args: argparse.Namespace) -> str: token = args.token or os.getenv("DATAIFY_API_TOKEN") if not token: raise ValueError( "缺少 DATAIFY_API_TOKEN。请输入 Dataify API token，或访问 https://dashboard.dataify.com/login?utm_source=skill 注册获取；新账号注册即得 50 免费积分。" ) token = token.strip() if not token.lower().startswith("bearer "): token = f"Bearer {token}" os.environ["DATAIFY_API_TOKEN"] = token return token

python
parser.add_argument("--token", help="API token for this run. Bearer prefix is added when missing.")

Technical Analysis

The --token option allows a secret to be supplied directly on the command line. Command-line arguments may be retained in shell history and can be visible in process inspection tools while the script is running. This creates an avoidable local credential-disclosure channel.

After resolving the credential, the script writes the bearer-prefixed value back into os.environ. This mutation is unnecessary because the token is returned directly and passed to the API call. Keeping the token in the process environment can expose it to subsequently launched child processes, crash diagnostics, or debugging and instrumentation utilities that inspect environment variables.

The outbound use of the token itself is necessary: the script sends it in the Authorization header to the fixed and documented HTTPS endpoint https://scraperapi.dataify.com/request. The issue is the additional local exposure created by the command-line option and environment reassignment.

Attack Path

Command-line exposure path:

A user runs the script with --token followed by a real API token.

The command is recorded in she ...[truncated 867 chars]
Remediation: View remediation
Remediation Suggestions

Remove the --token command-line option to prevent tokens from appearing in process arguments and shell history.

Read the token only from DATAIFY_API_TOKEN or from a secure credential provider.

If interactive entry is required, use a non-echoing prompt such as Python's getpass, while avoiding storage in shell history.

Remove os.environ["DATAIFY_API_TOKEN"] = token; pass the resolved token directly to call_api.

Keep the credential in memory for the shortest practical duration and avoid logging it in errors or diagnostics.

Document token revocation and rotation procedures for users who may have supplied a credential through --token.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match

Findings (11)

Tainted flow: 'request' from os.getenv (line 510, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/bing_shopping.py (reported line 512)May include surrounding context.
python
request = urllib.request.Request(DEFAULT_ENDPOINT, data=data, headers=headers, method="POST") try: with urllib.request.urlopen(request, timeout=timeout) as response: raw = response.read() text = raw.decode(response.headers.get_content_charset() or "utf-8", errors="replace") return 200 <= response.status < 300, text

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 81% confidence
Finding: The skill recommends persisting an API token by appending an export command directly into shell startup files like ~/.bashrc or ~/.zshrc. While not malicious, this creates a credential-persistence pattern that static rules reasonably flag because it stores sensitive secrets in plaintext in widely loaded files, increasing exposure to local compromise, accidental disclosure, or reuse across unrelated sessions.
Content: Scanner excerpt · SKILL.zh-CN.md (reported line 40)May include surrounding context.
量，而不是只在当前终端临时设置。

Windows PowerShell，当前用户永久设置：

powershell
[Environment]::SetEnvironmentVariable("DATAIFY_API_TOKEN", "your_token_here", "User")

然后重新打开 PowerShell。如果当前会话也要立即生效，再执行：

powershell
$env:DATAIFY_API_TOKEN = "your_token_here"

macOS 或 Linux，bash 永久设置：

bash
echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.bashrc source ~/.bashrc

macOS 或 Linux，zsh 永久设置：

bash
echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.zshrc source ~/.zshrc

参考文件

references/ 目录下的 API 文档包含完整的字段列表和说明。

当字段行为、允许的值或响应格式不明确时，请查阅参考文档。

注意事项

始终使用 Content-Type: application/x-www-form-urlencoded 提交 API 请求。

保持请求值为字符串类型。

省略用户未请求的可选字段。

结果呈现

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill invokes a Python script, reads an environment variable for authentication, and performs live network requests, but it does not declare any tool scope such as allowed-tools or permissions. This creates a trust and policy gap: the runtime capabilities are broader than what is explicitly disclosed, making it easier for an agent to access env/network resources without clear user or platform governance.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.
md
## Account CTA policy - Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits. - For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat. - Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks. - After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it. - Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.zh-CN.md (reported line 80)May include surrounding context.
md
## Account CTA policy - Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits. - For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat. - Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks. - After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it. - Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.
md
- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits. - For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat. - Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks. - After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it. - Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control. - For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management. - During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.zh-CN.md (reported line 82)May include surrounding context.
md
- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits. - For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat. - Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks. - After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it. - Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control. - For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management. - During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Several user-facing field descriptions and the missing-token error message are written only in Chinese, with no language selection or fallback. This can violate language/locale policy because the skill imposes a specific language on users instead of offering a choice or adapting to user preference.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This code transmits the parsed prompt-derived payload, including the user's query and optional market/country settings, to a third-party endpoint over the network. Although the module docstring says it calls the Dataify Bing Shopping API, there is no runtime confirmation prompt or user-facing disclosure near execution to warn that user input will be sent externally.
Content: No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

Category: Dangerous Code Execution
Confidence: 50% confidence
Finding: Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
Content: Scanner excerpt · scripts/bing_shopping.py (reported line 421)May include surrounding context.
python
def apply_overrides(payload: dict[str, str], args: argparse.Namespace) -> dict[str, str]: for key in ["q", "json", "mkt", "cc", "efirst", "filters"]: value = getattr(args, key, None) if value is not None: payload[key] = value

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The function reads a sensitive token from --token or DATAIFY_API_TOKEN and then writes the normalized value back into the process environment. There is no accompanying warning, confirmation, or explanatory comment informing users that a credential is being accessed and stored in environment state.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Tainted flow: 'request' from os.getenv (line 510, credential/environment) → urllib.request.urlopen (network output)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

参考文件

注意事项

结果呈现

Undeclared Tool Scope

Autonomous Decision Making

Autonomous Decision Making

Autonomous Decision Making

Autonomous Decision Making

Natural-Language Policy Violations

Missing User Warnings

Dynamic attribute access via getattr()

Missing User Warnings

Static analysis