Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly matches its Dataify brand-monitoring purpose, but it needs review because it handles a local API token in a risky way and includes inconsistent dependency instructions.
Review this before installing if you will use a real Dataify API token. Prefer a narrowly scoped or disposable token, watch account credit usage, avoid pasting tokens into chat, and be aware that task status/download requests place the token in URL query strings. The broader packaged workflows and localized Amazon dependency also deserve cleanup before this is treated as a tightly scoped brand-monitoring skill.
_dependencies/skills/scraper-amazon-comment/SKILL.zh-CN.md:93Localized Skill instruction forces promotional output after successful task creation
scripts/wait_for_task.py:34Dataify API token is transmitted in URL query strings
scripts/catalog_builder.py:67Generated curl preview permits shell injection through unescaped parameters
The skill appears to poll remote task endpoints, consume an API token from environment variables, and download arbitrary scraper results instead of performing direct brand-monitoring analysis. In context, that means the skill can function as a generic remote data-retrieval mechanism under a misleading description, raising both security and governance risks.
The skill appears to poll remote task endpoints, consume an API token from environment variables, and download arbitrary scraper results instead of performing direct brand-monitoring analysis. In context, that means the skill can function as a generic remote data-retrieval mechanism under a misleading description, raising both security and governance risks.
The skill appears to poll remote task endpoints, consume an API token from environment variables, and download arbitrary scraper results instead of performing direct brand-monitoring analysis. In context, that means the skill can function as a generic remote data-retrieval mechanism under a misleading description, raising both security and governance risks.
The skill appears to poll remote task endpoints, consume an API token from environment variables, and download arbitrary scraper results instead of performing direct brand-monitoring analysis. In context, that means the skill can function as a generic remote data-retrieval mechanism under a misleading description, raising both security and governance risks.
The skill appears to poll remote task endpoints, consume an API token from environment variables, and download arbitrary scraper results instead of performing direct brand-monitoring analysis. In context, that means the skill can function as a generic remote data-retrieval mechanism under a misleading description, raising both security and governance risks.
The skill appears to poll remote task endpoints, consume an API token from environment variables, and download arbitrary scraper results instead of performing direct brand-monitoring analysis. In context, that means the skill can function as a generic remote data-retrieval mechanism under a misleading description, raising both security and governance risks.
The skill appears to poll remote task endpoints, consume an API token from environment variables, and download arbitrary scraper results instead of performing direct brand-monitoring analysis. In context, that means the skill can function as a generic remote data-retrieval mechanism under a misleading description, raising both security and governance risks.
The skill appears to poll remote task endpoints, consume an API token from environment variables, and download arbitrary scraper results instead of performing direct brand-monitoring analysis. In context, that means the skill can function as a generic remote data-retrieval mechanism under a misleading description, raising both security and governance risks.
The skill appears to poll remote task endpoints, consume an API token from environment variables, and download arbitrary scraper results instead of performing direct brand-monitoring analysis. In context, that means the skill can function as a generic remote data-retrieval mechanism under a misleading description, raising both security and governance risks.
The skill appears to poll remote task endpoints, consume an API token from environment variables, and download arbitrary scraper results instead of performing direct brand-monitoring analysis. In context, that means the skill can function as a generic remote data-retrieval mechanism under a misleading description, raising both security and governance risks.
The skill appears to poll remote task endpoints, consume an API token from environment variables, and download arbitrary scraper results instead of performing direct brand-monitoring analysis. In context, that means the skill can function as a generic remote data-retrieval mechanism under a misleading description, raising both security and governance risks.
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
ershell $env:DATAIFY_API_TOKEN = "YOUR_TOKEN" if ($env:DATAIFY_API_TOKEN) { "configured" } else { "missing" }
Windows Command Prompt:
```cmd
set DATAIFY_API_TOKEN=YOUR_TOKEN
if defined DATAIFY_API_TOKEN (echo configured) else (echo missing)
macOS zsh:
echo 'export DATAIFY_API_TOKEN="YOUR_TOKEN"' >> ~/.zshrc
source ~/.zshrc
Linux bash:
echo 'export DATAIFY_API_TOKEN="YOUR_TOKEN"' >> ~/.bashrc
source ~/.bashrc
Windows PowerShell user environment:
[Environment]::SetEnvironmentVariable("DATAIFY_API_TOKEN", "YOUR_TOKEN", "User")
Windows Command Prompt user environment:
setx DATAIFY_API_TOKEN "YOUR_TOKEN"
Persistent changes affect new processes. Tell the user to open a new terminal or restart the agent application when the active process cannot see the updated value.
.envRecommend a project .env only when the actual command explicitly loads it. Creating the file alone does n
The lead workflow issues searches for LinkedIn company pages and Crunchbase organization pages, which is prospecting behavior rather than monitoring brand mentions, sentiment, or reputation risks. This is a clear semantic mismatch with the manifest’s stated purpose and goes beyond an implementation detail needed for brand listening.
This branch parses company entities, checks for hiring and target-role signals, and assigns qualification scores and score reasons for prospective companies. That is a dedicated lead-scoring capability, not brand monitoring, and directly conflicts with the manifest’s narrowly described monitoring use case.
The code evaluates hiring signals, target-role matches, and company-detail completeness to produce qualification scores for organizations. Such prospecting/qualification logic is not justified by a skill whose stated purpose is monitoring brand mentions, sentiment, and reputation risk across public sources.
This dependency skill is materially misaligned with the parent skill's declared purpose: instead of brand monitoring across public sources, it submits Amazon review-scraping jobs to a third-party service. That mismatch can cause the agent to collect data outside the user’s intended scope, trigger paid external actions, and bypass policy expectations about what this skill should do.
This dependency skill is for Amazon review scraping, but it is packaged under a brand-monitoring skill context. That mismatch expands the effective capability of the parent skill beyond its declared purpose, which can bypass policy expectations, user consent boundaries, and review controls tied to the manifest. In a brand-monitoring context, hidden or unjustified scraping functionality is more dangerous because it enables data collection workflows users and reviewers would not reasonably expect.
The manifest describes a skill for monitoring a brand across news, search, reviews, forums, or public social sources and explicitly says not to use it for one platform's raw posts. This code submits a task to scrape comments for a single Amazon product URL via the specific spider_id "amazon_comment_by-url", which is a narrow single-source/product review collection workflow rather than broad brand monitoring.
The skill declares no explicit tool scope or permissions even though it is designed to use environment access, file operations, network access, and shell execution. In an agent setting, this weakens least-privilege controls and makes it harder to constrain misuse if the skill is repurposed or if downstream scripts behave unexpectedly.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
## Account CTA policy
- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
## Account CTA policy
- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
## Account CTA policy
- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
## Account CTA policy
- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
- For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management.
- During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
- For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management.
- During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.