ClawHub
Back to skill

Security audit

Dataify Competitive Intelligence

Security checks for vulnerabilities and agentic risk

Overview

This skill performs bounded public competitor research with Dataify and local reporting helpers, and the sensitive behaviors are disclosed and purpose-aligned.

Install this only if you are comfortable using Dataify services for public-web research, storing evidence files locally, and potentially spending credits on successful requests. Use dry-run, checkpoints, and max-actions for cost control, and keep the API token in the environment rather than chat.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill describes and encourages use of powerful capabilities including environment-variable access, file read/write, network access, and shell execution, but it does not declare any explicit tool scope or permissions boundary in the manifest. That creates an over-privileged and under-specified execution model where an agent may invoke sensitive capabilities implicitly, making review, policy enforcement, and least-privilege control difficult.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## Account CTA policy

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
Confidence
80% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
- For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management.
- During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The skill enables implicit invocation without any visible trigger constraints, so the platform may auto-select it in broader contexts than intended. For a competitive-intelligence skill that performs public-web research and comparative analysis, this can cause unintended data access, unnecessary external calls, or responses shaped by the skill when the user did not explicitly request it.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
command = [sys.executable, str(runner), "--resume", str(run_dir), "--autopilot"]
    if args.dry_run:
        command.append("--dry-run")
    result = subprocess.run(command, check=False)
    if result.returncode != 0 or args.dry_run:
        return result.returncode
    old_evidence = baseline_state.parent / "evidence.json"
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
if required is not None and not required.exists():
        return direct_request(action, token)
    command = command_for(action)
    return subprocess.run(
        command, capture_output=True, text=True, encoding="utf-8", errors="replace", check=False
    )
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Medium
Confidence
94% confidence
Finding
The required-concept patterns explicitly include Chinese terms such as '置信度', '局限', and '建议', meaning the skill embeds language-specific expectations in its validation logic. Because the file does not indicate that this is a region-specific tool or provide an opt-in language choice, this can violate the policy against forcing a specific language/locale without user opt-in.

Static analysis

No suspicious patterns detected.