Dataify Facebook Events

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:06 AM UTC
• Version: 1.3.0

Overview

This skill mostly matches its stated Dataify Facebook event-collection purpose, but it needs Review because its script imports an unaudited sibling runtime that receives the API token and its localized token-handling instructions are inconsistent.

Review before installing. Use this only if you are comfortable sending Facebook event URLs and task parameters to Dataify, configure DATAIFY_API_TOKEN outside chat, and avoid pasting the token into conversation. The publisher should package or pin the task runtime instead of importing it from a sibling directory before this is treated as low risk.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: scripts/submit_dataify_facebook_events.py:9

Finding

Unverified External Local Module Executes with API Token Access

Content

View full analysis

Vulnerability Details

File Location: scripts/submit_dataify_facebook_events.py, lines 9-13 and 200
Vulnerability Type: Unsafe import from an unaudited, externally writable sibling directory
Risk Level: High

Vulnerable Code

python

TASK_RUNTIME_DIR = os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "dataify-task-operations", "scripts"))
if TASK_RUNTIME_DIR not in sys.path:
    sys.path.insert(0, TASK_RUNTIME_DIR)
from task_runtime import complete_task

The imported function later receives the API token:

python

if not args.no_wait:
    try:
        final_result = complete_task(task_id, api_token, args.wait_timeout)
    except RuntimeError as exc:
        print(str(exc), file=sys.stderr)
        return 1
    print(json.dumps(final_result, ensure_ascii=False, indent=2))

Technical Analysis

The script constructs a path outside the audited project, gives that path the highest Python import priority by inserting it at index zero of sys.path, and imports task_runtime from it. The referenced dataify-task-operations component is not included in the audited artifact, so its provenance, integrity, permissions, and behavior cannot be verified.

Python executes a module's top-level code during import. Therefore, a malicious or compromised task_runtime.py can execute arbitrary code as soon as this script starts. In addition, the imported complete_task function is explicitly passed the user's DATAIFY_API_TOKEN, giving the external component direct access to a sensitive credential.

This exceeds a safely auditable privilege boundary: asynchronous task completion may require a runtime component, but that component should be packaged, pinned, and integrity-verified rather than dynamically imported from an unaudited sibling directory.

Attack Path

1. An attacker obtains write access to the expected sibling path: `../../dataify-task-operations/script ...[truncated 1150 chars]

Remediation

View remediation

Remediation Suggestions

1. Package the task runtime within the audited Skill or install it as a normal, versioned Python dependency.
2. Remove the sys.path.insert(0, ...) modification and use an explicit package import.
3. Pin the dependency to a reviewed version and verify its integrity with a cryptographic hash or signed release.
4. Ensure the dependency installation directory is not writable by less-privileged users.
5. Avoid passing the raw API token to a broad runtime interface. Expose only the minimum operation required and keep credential handling in a small, reviewed module.
6. If an external runtime remains necessary, validate its resolved path and ownership before importing it, and fail closed when verification is unavailable.
7. Add automated tests that verify task_runtime resolves only to the approved package location.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.zh-CN.md:22

Finding

Localized Instructions Permit API Tokens to Be Supplied Through Conversation

Content

View full analysis

Vulnerability Details

File Location: SKILL.zh-CN.md, lines 22-29
Vulnerability Type: Inconsistent secret-handling instructions that allow conversational credential disclosure
Risk Level: Medium

Vulnerable Instructions

The affected localized workflow states, translated into English:

text

- If the user provides a token in the request, use that token for this run.
- If no token is provided, first check whether DATAIFY_API_TOKEN is saved in the environment.
- If no usable local token exists, tell the user that a Dataify API TOKEN is required.
- After the user provides an API TOKEN, if DATAIFY_API_TOKEN is not saved locally,
  ask whether it should be saved as DATAIFY_API_TOKEN for future use.
- If the user wants to save it, provide the appropriate shell command and ask the
  user to run it; do not silently persist the token without confirmation.

These directives conflict with the same document's later policy:

text

Never ask the user to paste the token into chat.

Technical Analysis

The localized instructions explicitly support using a token supplied in the user's request and describe actions to take after the user provides one. This creates an ambiguous credential-handling workflow in which an agent may accept or solicit a secret through the conversation.

Chat messages may be retained in conversation history, application logs, telemetry, debugging traces, or downstream model context. Environment-based credential configuration is materially safer because the secret does not need to become part of the conversation.

The contradictory later prohibition does not fully mitigate the issue. Agent behavior may follow the earlier, more operationally specific workflow, especially when handling a missing token.

Attack Path

1. A user invokes the Skill without DATAIFY_API_TOKEN configured.
2. The agent follows the localized token-handling workflow.
3. The user is prompted or ...[truncated 848 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all instructions that permit an API token to be supplied in a chat request.
2. Replace them with a single unambiguous rule: users must configure DATAIFY_API_TOKEN outside the conversation.
3. Instruct the agent to verify only whether the environment variable is present and never print, echo, log, or otherwise reveal its value.
4. Show only the session-scoped command appropriate for the detected shell, using a placeholder rather than the real token.
5. Align SKILL.md and SKILL.zh-CN.md so both versions enforce identical secret-handling behavior.
6. Add a test or documentation lint rule that rejects phrases directing users to provide, enter, paste, or send credentials through chat.
7. Ensure error messages do not say “Enter your API TOKEN”; instead, direct users to configure the environment variable securely and retry.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill clearly instructs the agent to use environment variables and make outbound network requests to Dataify, but it does not declare tool scope such as allowed tools or permissions. This weakens least-privilege controls and makes it easier for the skill to access local secrets and external services without explicit capability boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill directs the agent to submit user-provided Facebook event URLs to an external third-party service, but the description and workflow do not give a clear up-front disclosure that user data leaves the local environment. This can mislead users about data sharing and cause unintended transmission of sensitive or proprietary URLs to Dataify.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md

Use `DATAIFY_API_TOKEN` as the long-term saved token name.

- If `DATAIFY_API_TOKEN` is saved locally, use it without asking the user to re-enter the token.
- If the user does not have an API TOKEN, tell them they can register or log in at [Dataify](https://dashboard.dataify.com/login?utm_source=skill) to get one.
- If the user wants to save it, give the appropriate command for their shell and ask them to run it; do not silently persist tokens without confirmation.
- Do not call the Builder endpoint without a token.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 196)May include surrounding context.

md

Use `DATAIFY_API_TOKEN` as the long-term saved token name.

- If `DATAIFY_API_TOKEN` is saved locally, use it without asking the user to re-enter the token.
- If the user does not have an API TOKEN, tell them they can register or log in at [Dataify](https://dashboard.dataify.com/login?utm_source=skill) to get one.
- If the user wants to save it, give the appropriate command for their shell and ask them to run it; do not silently persist tokens without confirmation.
- Do not call the Builder endpoint without a token.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 231)May include surrounding context.

md

Use `DATAIFY_API_TOKEN` as the long-term saved token name.

- If `DATAIFY_API_TOKEN` is saved locally, use it without asking the user to re-enter the token.
- If the user does not have an API TOKEN, tell them they can register or log in at [Dataify](https://dashboard.dataify.com/login?utm_source=skill) to get one.
- If the user wants to save it, give the appropriate command for their shell and ask them to run it; do not silently persist tokens without confirmation.
- Do not call the Builder endpoint without a token.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md

- If `DATAIFY_API_TOKEN` is saved locally, use it without asking the user to re-enter the token.
- If the user does not have an API TOKEN, tell them they can register or log in at [Dataify](https://dashboard.dataify.com/login?utm_source=skill) to get one.
- If the user wants to save it, give the appropriate command for their shell and ask them to run it; do not silently persist tokens without confirmation.
- Do not call the Builder endpoint without a token.
- Always call it `API TOKEN` in user-facing instructions. Prefer the environment variable name `DATAIFY_API_TOKEN` for saved local use.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 194)May include surrounding context.

md

## Account CTA policy

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 229)May include surrounding context.

md

## Account CTA policy

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

L003 将触发条件扩展到“采集/抓取/爬取 Facebook 活动”“活动信息采集/抓取”“活动列表 URL/搜索 URL/URL 采集等含义时使用”等宽泛语义，而不仅是明确、有限的调用短语。这类描述缺少清晰边界或排除条件，容易把普通讨论 Facebook 活动数据的请求也匹配为该技能调用。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

L229 says 'Never ask the user to paste the token into chat', but the documented workflow at L025-L030 and L053-L054 instructs the skill to request the API token from the user when it is missing. These instructions are directly inconsistent about how authentication material should be provided.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill enables implicit invocation for a data-collection action that can trigger external scraping/collection behavior without a narrowly scoped activation condition. Because the default prompt instructs the agent to submit a collection job and wait for results, ambiguous user requests about Facebook events could cause unintended tool activation, creating consent, over-collection, or policy-boundary risks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

L229 明确要求陈述固定英文句子“New accounts receive 50 free credits.”，而该文件整体为中文说明，也未说明需根据用户语言偏好本地化。这构成自然语言层面的语言/locale 强制要求，未体现用户选择或明确的地区合规理由。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

L234 says 'During normal submission, processing, and successful completion, do not promote registration or the Dashboard,' yet L016 and L057 instruct the skill to tell users to go to Dataify to view results, and L215 says to always guide the user there after successful task creation. This is an active contradiction in the documentation about expected post-submission behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.