Dataify Booking Hotel Info

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:58 AM UTC
• Version: 1.3.0

Overview

The skill has a legitimate Booking.com data-collection purpose, but its localized instructions and helper script create review-worthy credential and workflow risks.

Review this skill before installing. Use it only if you are comfortable sending target Booking.com URLs and a Dataify API token to Dataify, avoid pasting real tokens into chat or command arguments, prefer session-scoped environment variables over persistent shell startup files, and be aware that the Chinese instructions do not match the primary workflow for returning results.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.zh-CN.md:62

Finding

Localized instructions hijack the completion workflow and force a third-party dashboard redirect

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.zh-CN.md:24

Finding

Instructions persist the API token in plaintext shell startup configuration

Content

View full analysis

> ~/.bashrc source ~/.bashrc ``` ```bash echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.zshrc source ~/.zshrc ``` ### Technical Analysis The instructions recommend storing a long-lived API token persistently. On Linux and macOS, the literal token is appended to plaintext shell startup files. Any process or user able to read those files can recover the credential. The Windows instruction similarly creates a persistent per-user environment value rather than using a credential manager. This guidance conflicts with the safer policy in `SKILL.md:88-90` and `SKILL.zh-CN.md:90-92`, which requires presenting a session-scoped setup command first and only discussing persistent setup when requested. Although these changes do not install a backdoor or startup service, they unnecessarily expand the lifetime and exposure surface of an authentication secret beyond the execution of the Skill. ### Attack Path 1. A user follows the localized token setup instructions. 2. The Dataify API token is written to `~/.bashrc`, `~/.zshrc`, or a persistent user environment value. 3. The credential survives the Skill invocation and future terminal sessions. 4. A local process, another user with read access, a malicious developer tool, backup collector, or later account compromise reads the persisted value. 5. The attacker authenticates to Dataify as the victim and uses the victim's account or credits. ### Impact Assessment An attacker who obtains the token may gain the same Dataify API privileges as the token owner, including: - Submitting tasks under the victim's account - Consuming account credits - Accessing task data ...[truncated 203 chars]

Remediation

View remediation

T07 · Tool Hijacking and Spoofing

Warning

• Location: scripts/booking_hotellist.py:16

Finding

Unverified executable module is imported from outside the audited Skill directory

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/booking_hotellist.py:49

Finding

API token can be supplied through a command-line argument

Content

View full analysis

str: token = clean_value(token) or clean_value(os.environ.get("DATAIFY_API_TOKEN")) if not token: raise SystemExit(TOKEN_MISSING_MESSAGE) if token.lower().startswith("bearer "): return token return f"Bearer {token}" ``` ### Technical Analysis Command-line arguments are not an appropriate channel for reusable credentials. Depending on the operating system and shell, a token supplied through `--token` may be: - Saved in shell history - Visible in process listings - Captured by process-monitoring or telemetry software - Included in diagnostic reports or command logs The command-line value takes precedence over `DATAIFY_API_TOKEN`, making this unsafe mechanism a supported authentication path. This also conflicts with the documentation policy that users should not paste tokens into chat. ### Attack Path 1. A user runs the script with `--token REAL_TOKEN`. 2. The shell records the complete command or the operating system exposes it through process metadata. 3. Another local user, process-monitoring tool, log collector, or later shell-history reader obtains the token. 4. The recovered token is used to authenticate to Dataify. ### Impact Assessment Exposure grants the attacker the API capabilities associated with the token, potentially including task submission, credit consumption, and task-data access. The vulnerability is local and requires access to process information, command logs, or shell history; it does not grant operating-system privilege escalation. ]]>

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/booking_hotellist.py:94

Finding

Unvalidated target URLs are transmitted to the external scraping service

Content

View full analysis

list[dict[str, str]]: provided_sets = load_parameter_sets(args.parameters_json) if provided_sets is None: provided_sets = [{"url": clean_value(args.url)}] normalized_sets: list[dict[str, str]] = [] for item in provided_sets: url = clean_value(item.get("url")) if not url: raise SystemExit("Missing required field: url") normalized_sets.append({"url": url}) return normalized_sets ``` The accepted value is included in the external request: ```python def call_api(form: dict[str, str], token: str, timeout: float) -> str: encoded = urllib.parse.urlencode(form).encode("utf-8") request = urllib.request.Request( API_URL, data=encoded, method="POST", headers={ "Authorization": token, "Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json", }, ) ``` ### Technical Analysis The Skill declares that the required input is a Booking.com hotel or listing URL, but the script only verifies that the value is nonempty. It does not validate: - URL scheme - Hostname - Presence of embedded credentials - Whether the URL belongs to Booking.com - Potentially sensitive query or fragment values Every accepted value is serialized into `spider_parameters` and transmitted to `https://scraperapi.dataify.com/builder?platform=1`. A user or upstream Agent can therefore accidentally send an unrelated private URL, signed URL, or URL containing sensitive query data to Dataify. The normal transmission of a Dataify bearer token in the `Authorization` header is necessary for the declared hosted API and is not, by itself, credential exfiltration. The weakn ...[truncated 921 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (11)

Tainted flow: 'request' from os.environ.get (line 133, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/booking_hotellist.py (reported line 144)May include surrounding context.

python

},
    )
    try:
        with urllib.request.urlopen(request, timeout=timeout) as response:
            return response.read().decode("utf-8", errors="replace")
    except urllib.error.HTTPError as exc:
        body = exc.read().decode("utf-8", errors="replace")

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 43)May include surrounding context.

量，而不是只在当前终端临时设置。

Windows PowerShell，当前用户永久设置：

powershell

[Environment]::SetEnvironmentVariable("DATAIFY_API_TOKEN", "your_token_here", "User")

然后重新打开 PowerShell。如果当前会话也要立即生效，再执行：

powershell

$env:DATAIFY_API_TOKEN = "your_token_here"

macOS 或 Linux，bash 永久设置：

bash

echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.bashrc
source ~/.bashrc

macOS 或 Linux，zsh 永久设置：

bash

echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.zshrc
source ~/.zshrc

核心工作流程

1. 从用户请求中识别采集模式。
2. 提交前，以 Markdown 表格展示必填参数、可选参数和默认值。
3. 规范化并验证最终参数值。
4. 获取 Dataify token（用户提供或已保存的 DATAIFY_API_TOKEN）。
5. 如果没有 token，提示用户前往 Dataify 获取。
6. 提

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill uses environment access and makes outbound network requests, but it does not declare any explicit tool scope such as permissions or allowed-tools. This weakens containment and reviewability because an agent may invoke capabilities beyond what is transparently documented, increasing the chance of unintended credential access or external data transmission.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

md

## Account CTA policy

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 89)May include surrounding context.

md

## Account CTA policy

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

md

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
- For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management.
- During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 91)May include surrounding context.

md

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
- For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management.
- During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger description includes very broad verbs such as gather/scrape/crawl/fetch/extract/collect, which can match many ordinary user requests unrelated to Booking URLs. Overbroad activation can cause the wrong skill to run, leading to unintended external requests, unnecessary credential prompts, or data collection actions the user did not actually intend.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill recommends long-term storage of an API token in environment variables and shell startup files but does not include sufficient security guidance about local exposure, shell-history risks, shared-user systems, or secret revocation/rotation. This can lead users to persist credentials insecurely and forget they are broadly available to local processes.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill allows use of a token 'provided in the request' while later policy says to never ask the user to paste the token into chat. This inconsistency can normalize secret submission through chat, increasing the chance that API credentials are exposed in conversation logs, retained by platforms, or mishandled by downstream tooling.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

L06 将文档定位为“中文版”，且全文实际仅提供中文说明，没有看到为用户提供语言选择或说明该语言限制的业务必要性。根据语言/locale 政策，若技能强制特定语言而无用户选择或明确合理依据，可能构成自然语言策略问题。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.