Security audit

dataify-duckduckgo-search

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Dataify-backed DuckDuckGo search helper with user confirmation before network calls, though users should treat the Dataify token and search queries as third-party data.

Install only if you are comfortable sending your search queries to Dataify and using a Dataify API token. Prefer setting DATAIFY_API_TOKEN in the environment rather than pasting tokens into chat or command arguments.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill invokes a local Python script that uses both network access and environment-derived secrets, yet the skill metadata declares no permissions. This undermines informed consent and policy enforcement because reviewers and users cannot accurately assess that the skill can contact external services and read `DATAIFY_API_TOKEN` from the environment.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill is presented as a DuckDuckGo search helper, but it actually routes requests through a third-party Dataify API and solicits a Dataify token. That mismatch can mislead users into disclosing credentials and search queries to an unexpected intermediary, increasing privacy, compliance, and supply-chain risk.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The script writes the provided API token back into the process environment via DATAIFY_API_TOKEN, expanding the token's lifetime and visibility to subprocesses or other components that can inspect inherited environment variables. For a simple search skill, this persistence is unnecessary and increases credential exposure without a clear functional need.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The workflow instructs the agent to show a preview table with the complete field list except `Authorization`, while also allowing the user to pass a token explicitly via `--token`. Because the token is not named `Authorization`, this creates a realistic path for secret exposure in chat transcripts, logs, screenshots, or shared terminal output.

Env Variable Harvesting

High

Category: Data Exfiltration
Content: "未检测到 Dataify API token。请提供 --token，设置 DATAIFY_API_TOKEN，或前往 https://dashboard.dataify.com/login?utm_source=skill 注册获取。" ) os.environ["DATAIFY_API_TOKEN"] = token if not re.match(r"^Bearer\s+", token, flags=re.IGNORECASE): token = f"Bearer {token}" return token
Confidence: 95% confidence
Finding: os.environ["DATAIFY_API_TOKEN"]

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical

Code: suspicious.secret_argv_exposure
Location: SKILL.md:25

Instructions pass high-value credentials through process argv.

Critical

Code: suspicious.secret_argv_exposure
Location: SKILL.zh-CN.md:25