Dataify Facebook Post By URL

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:59 AM UTC
• Version: 1.3.0

Overview

This Dataify skill mostly matches its stated purpose, but its helper script loads an unaudited local runtime that can execute code and receive the API token.

Install only if you are comfortable sending Facebook post URLs, file names, and task metadata to Dataify and using Dataify credits. Verify any dataify-task-operations runtime comes from a trusted source before using the helper script, and configure DATAIFY_API_TOKEN through the environment rather than pasting tokens into chat.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: scripts/submit_dataify_facebook_post_by_url.py:11

Finding

Untrusted Out-of-Project Runtime Import Can Execute Arbitrary Code and Access the API Token

Content

View full analysis

Vulnerability Details

File Location: scripts/submit_dataify_facebook_post_by_url.py, lines 11-14 and 176-178
Vulnerability Type: Unsafe dependency loading from a mutable sibling directory
Risk Level: High

Vulnerable Code:

python

TASK_RUNTIME_DIR = os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "dataify-task-operations", "scripts"))
if TASK_RUNTIME_DIR not in sys.path:
    sys.path.insert(0, TASK_RUNTIME_DIR)
from task_runtime import complete_task

python

if not args.no_wait:
    try:
        final_result = complete_task(task_id, api_token, args.wait_timeout)

Technical Analysis

The script constructs a path outside the audited project, places that directory at the beginning of sys.path, and imports task_runtime without version pinning, integrity verification, or package-origin validation.

Because Python executes module-level code during import, any task_runtime.py placed in the sibling dataify-task-operations/scripts directory executes as soon as this script starts. This occurs before argument processing and therefore can also happen for invocations such as --help or --no-wait.

During the normal task-monitoring workflow, the imported complete_task function is explicitly given the reusable DATAIFY_API_TOKEN. The external module is not included in the audited artifact, so its implementation, provenance, and credential-handling behavior cannot be verified. Although asynchronous monitoring is part of the declared functionality, trusting mutable code outside the Skill package without verification exceeds the minimum dependency trust boundary necessary to implement that behavior.

Attack Path

1. An attacker obtains write access to the sibling dataify-task-operations/scripts directory or compromises its installation/update source.
2. The attacker creates or replaces task_runtime.py with malicious Python code.
3. A user or Agent invokes ...[truncated 1166 chars]

Remediation

View remediation

Remediation Suggestions

1. Package task_runtime inside the Skill or install it as a formally declared dependency from a trusted, authenticated source.
2. Pin the dependency to an exact version and verify its cryptographic hash or signed release before execution.
3. Remove the sys.path.insert(0, ...) pattern. Use a normal package import whose origin is controlled by the application.
4. If an external runtime remains necessary, resolve its canonical path and verify that it is an expected regular file owned by a trusted account and not writable by untrusted users.
5. Defer importing the monitoring runtime until after argument parsing and only when --no-wait is not selected. This reduces unnecessary exposure but does not replace provenance verification.
6. Validate the imported module's resolved __file__ against an approved installation directory before invoking it.
7. Prefer a narrow monitoring interface that does not give an unaudited component a reusable API token. Where supported, use a task-scoped, read-only, short-lived credential.
8. Add dependency integrity and module-origin checks to automated tests and release validation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill requires access to environment variables and outbound network calls, but it does not declare any explicit tool scope or allowed-tools restrictions. That weakens least-privilege controls and makes it easier for an agent runtime to grant broader capabilities than necessary, increasing the blast radius if the skill is misused or later modified.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

Use `DATAIFY_API_TOKEN` as the long-term saved token name.

- If `DATAIFY_API_TOKEN` is saved locally, use it without asking the user to re-enter the token.
- If the user does not have an API TOKEN, tell them they can register or log in at [Dataify](https://dashboard.dataify.com/login?utm_source=skill) to get one.
- If the user wants to save it, give the appropriate command for their shell and ask them to run it; do not silently persist tokens without confirmation.
- Do not call the Builder endpoint without a token.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.

md

Use `DATAIFY_API_TOKEN` as the long-term saved token name.

- If `DATAIFY_API_TOKEN` is saved locally, use it without asking the user to re-enter the token.
- If the user does not have an API TOKEN, tell them they can register or log in at [Dataify](https://dashboard.dataify.com/login?utm_source=skill) to get one.
- If the user wants to save it, give the appropriate command for their shell and ask them to run it; do not silently persist tokens without confirmation.
- Do not call the Builder endpoint without a token.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 159)May include surrounding context.

md

Use `DATAIFY_API_TOKEN` as the long-term saved token name.

- If `DATAIFY_API_TOKEN` is saved locally, use it without asking the user to re-enter the token.
- If the user does not have an API TOKEN, tell them they can register or log in at [Dataify](https://dashboard.dataify.com/login?utm_source=skill) to get one.
- If the user wants to save it, give the appropriate command for their shell and ask them to run it; do not silently persist tokens without confirmation.
- Do not call the Builder endpoint without a token.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md

- If `DATAIFY_API_TOKEN` is saved locally, use it without asking the user to re-enter the token.
- If the user does not have an API TOKEN, tell them they can register or log in at [Dataify](https://dashboard.dataify.com/login?utm_source=skill) to get one.
- If the user wants to save it, give the appropriate command for their shell and ask them to run it; do not silently persist tokens without confirmation.
- Do not call the Builder endpoint without a token.
- Always call it `API TOKEN` in user-facing instructions. Prefer the environment variable name `DATAIFY_API_TOKEN` for saved local use.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill gives conflicting secret-handling instructions: earlier sections tell the agent to ask the user for the API token, while the CTA policy later says never to ask the user to paste the token into chat. This inconsistency can cause an agent to collect credentials through the conversation channel, increasing the risk of secret exposure in logs, transcripts, or downstream tooling.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

该中文技能文件在“Account CTA policy”段落中改为要求输出英文固定文案与英文界面交互规则，如 L157 的英文陈述和整段英文操作要求，但没有说明这是用户可选项或仅在特定场景适用。根据规则，未征得用户同意就强制特定语言/locale 属于自然语言政策违规。

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

md

## Account CTA policy

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 157)May include surrounding context.

md

## Account CTA policy

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill enables implicit invocation globally without any trigger constraints, so an agent may call this external data-collection capability automatically based on loose user intent matching. Because the tool fetches data from user-supplied Facebook post URLs and performs asynchronous collection, this increases the risk of unintended third-party requests, privacy-sensitive data retrieval, and reduced user awareness or consent before network actions occur.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code performs an HTTP POST to an external Dataify endpoint and includes both the user's requested parameters and a bearer token. Although the script name and argument text imply submission, there is no explicit warning or disclosure in-code that input URLs and authentication data will be sent to a third-party service.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The core workflow at L046 and the security rule at L143 both say to tell the user to go to Dataify to view/manage results after success. However, L162 says that during normal submission, processing, and successful completion, the skill should not promote registration or the Dashboard, which is an active contradiction in user-facing intent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.