ClawHub
Back to skill

Security audit

"dataify-crunchbase-company-by-url"

Security checks across malware telemetry and agentic risk

Overview

The skill is a disclosed helper for generating Dataify Crunchbase builder curl requests, with credential and data-sharing cautions users should understand before use.

Before installing, understand that generated requests are meant to send your Dataify token and chosen scraper parameters to Dataify's scraperapi.dataify.com endpoint. Avoid placing secrets or unnecessary sensitive business data in parameters, and consider using session-only or managed secret storage instead of permanently writing the API token into shell startup files.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill instructs users to persist a sensitive API token in shell startup files and the Windows user environment without any warning about credential exposure, file permissions, shell history, multi-user systems, or safer secret-management alternatives. This increases the chance of long-lived token leakage and reuse if the host is shared, backed up insecurely, or compromised.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill tells the user to build a curl request that sends a Bearer token and user-supplied scraper parameters to an external third-party endpoint, but it does not clearly warn that data will leave the local environment. This can lead to unintentional disclosure of sensitive URLs, company data, or other parameters to the remote service.

External Transmission

Medium
Category
Data Exfiltration
Content
---
name: "dataify-crunchbase-company-by-url"
description: "Prepare Dataify builder requests for the crunchbase.com scraper family rooted at crunchbase_company_by-url. Use  when needs to work with the successful Dataify scraper detail entry for crunchbase_company_by-url, let the user choose one of its available tools, read saved getToolParams options, and generate a scraperapi.dataify.com/builder curl request with DATAIFY_API_TOKEN."
---

# Dataify Builder Skill
Confidence
86% confidence
Finding
curl request with DATAIFY_API_TOKEN." --- # Dataify Builder Skill Use this skill to prepare Dataify builder requests for the scraper family rooted at `crunchbase_company_by-url` on `crunchbase.com`.

External Transmission

Medium
Category
Data Exfiltration
Content
---
name: "dataify-crunchbase-company-by-url"
description: "为 crunchbase.com 上以 crunchbase_company_by-url 为根的 scraper 系列准备 Dataify builder 请求。当需要处理成功的 Dataify scraper detail 条目 crunchbase_company_by-url、让用户选择可用工具、读取已保存的 getToolParams 选项，并使用 DATAIFY_API_TOKEN 生成 scraperapi.dataify.com/builder curl 请求时，使用此 skill。"
---

# Dataify Builder Skill 中文版
Confidence
83% confidence
Finding
curl 请求时，使用此 skill。" --- # Dataify Builder Skill 中文版 这个 skill 用于为 `crunchbase.com` 下、以 `crunchbase_company_by-url` 为入口的 Dataify scraper 工具族生成 builder 请求。 ## 工作流程 1. 先检查环境变量中是否存在 `DATAIFY_API_TOKEN

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.