Dataify eBay Products

• Outcome: Pass
• Latest audit: Jul 17, 2026 · 12:35 AM UTC
• Version: 1.2.0

Overview

This skill is a disclosed Dataify eBay task-submission helper that uses a Dataify API token and network access for its stated purpose.

Install only if you intend to let the agent submit eBay product collection jobs to Dataify. Review prompts before submission, and store DATAIFY_API_TOKEN only if you are comfortable with future Dataify tasks using that saved token.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill instructs the agent to read a locally saved API token from the environment and submit network requests, but it declares no permissions or trust boundaries for those capabilities. Hidden or undeclared access to env and network increases the risk of unexpected secret use and outbound data transmission, especially in a skill that can be broadly activated.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The activation text is overly broad and includes generic phrases such as token configuration, status handling, and troubleshooting, which can cause the skill to trigger outside a clear user request for eBay data collection. Overbroad invocation increases the chance that the skill will access saved credentials or steer the conversation into network actions in contexts where the user did not intend to use this integration.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The skill description contains a very broad set of trigger phrases, including generic scraping, collection, troubleshooting, and token-handling language in both English and Chinese. This can cause the agent to invoke the skill in conversations that only partially match the user's intent, leading to unintended task submission flows or unnecessary prompting for API credentials.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The skill enables implicit invocation, and the metadata/description show a broad set of activation phrases spanning generic scraping, collection, troubleshooting, task status, and configuration scenarios. That creates an ambiguous trigger surface where the agent may invoke this skill without a clearly bounded user intent, causing unintended submission of external Dataify eBay collection tasks or disclosure/use of configured API-backed capabilities.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- If the user provides a token in the request, use it for this run.
- If no token is provided, first check whether `DATAIFY_API_TOKEN` is already saved locally in the environment.
- If `DATAIFY_API_TOKEN` is saved locally, use it without asking the user to re-enter the token.
- If no token is available locally, tell the user they need to provide a Dataify API TOKEN.
- If the user does not have an API TOKEN, tell them they can register or log in at [Dataify](https://dashboard.dataify.com/login?utm_source=skill) to get one.
- If the user already has an API TOKEN, tell them it is available in the top-right area of [Dataify](https://dashboard.dataify.com?utm_source=skill).

• Confidence: 87% confidence
• Finding: The skill authorizes automatic use of a locally saved `DATAIFY_API_TOKEN` without re-prompting the user. Using persisted credentials autonomously can cause unintended third-party requests under the user's account, especially if the skill was activated by a vague or ambiguous prompt.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.