T08 · Insecure Dependencies
Warning
- Location
scripts/submit_dataify_facebook_profile_by_url.py:11- Finding
Unverified External Runtime Is Loaded and Given the API Token
- Content
View full analysis
- Remediation
View remediation
Security audit
Dataify Facebook Profile By URL
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly aligned with its stated Dataify collection purpose, but it needs review because it handles personal-profile collection, long-lived API tokens, implicit invocation, and an unreviewed helper import.
Review before installing. Use this only if you intend to send Facebook profile URLs to Dataify and potentially spend account credits. Configure DATAIFY_API_TOKEN through an environment variable or secret manager, do not paste the token into chat, and only use the default wait/result retrieval flow if you trust the separate dataify-task-operations helper available in the runtime environment.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.zh-CN.md:14- Finding
Localized Instructions Encourage API Token Disclosure Through Chat
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 96% confidence
- Finding
The skill declares behavior that uses environment variables and outbound network access, but it does not declare any corresponding tool scope or permission boundaries. This weakens least-privilege controls and can allow an agent runtime to perform sensitive actions without clear user/auditor visibility into what capabilities the skill expects.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md Use `DATAIFY_API_TOKEN` as the long-term saved token name. - If `DATAIFY_API_TOKEN` is saved locally, use it without asking the user to re-enter the token. - If the user does not have an API TOKEN, tell them they can register or log in at [Dataify](https://dashboard.dataify.com/login?utm_source=skill) to get one. - If the user wants to save it, give the appropriate command for their shell and ask them to run it; do not silently persist tokens without confirmation. - Do not call the Builder endpoint without a token.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md Use `DATAIFY_API_TOKEN` as the long-term saved token name. - If `DATAIFY_API_TOKEN` is saved locally, use it without asking the user to re-enter the token. - If the user does not have an API TOKEN, tell them they can register or log in at [Dataify](https://dashboard.dataify.com/login?utm_source=skill) to get one. - If the user wants to save it, give the appropriate command for their shell and ask them to run it; do not silently persist tokens without confirmation. - Do not call the Builder endpoint without a token.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md Use `DATAIFY_API_TOKEN` as the long-term saved token name. - If `DATAIFY_API_TOKEN` is saved locally, use it without asking the user to re-enter the token. - If the user does not have an API TOKEN, tell them they can register or log in at [Dataify](https://dashboard.dataify.com/login?utm_source=skill) to get one. - If the user wants to save it, give the appropriate command for their shell and ask them to run it; do not silently persist tokens without confirmation. - Do not call the Builder endpoint without a token.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - If `DATAIFY_API_TOKEN` is saved locally, use it without asking the user to re-enter the token. - If the user does not have an API TOKEN, tell them they can register or log in at [Dataify](https://dashboard.dataify.com/login?utm_source=skill) to get one. - If the user wants to save it, give the appropriate command for their shell and ask them to run it; do not silently persist tokens without confirmation. - Do not call the Builder endpoint without a token. - Always call it `API TOKEN` in user-facing instructions. Prefer the environment variable name `DATAIFY_API_TOKEN` for saved local use.
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
L008 and again L046/L143 instruct the agent to tell users to go to the Dataify dashboard to view results after submission succeeds. But L162 states that during normal submission, processing, and successful completion, the skill should not promote registration or the Dashboard. This is an active contradiction in operator guidance.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill contains contradictory token-handling guidance: early instructions say the user may provide the API token in the request/input, while the later CTA policy says to never ask the user to paste the token into chat. In a chat-based skill, this inconsistency can cause the agent to solicit secrets through the conversation channel, increasing the risk of credential exposure in logs, transcripts, or downstream tooling.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This file is a Chinese-language skill document, but the 'Account CTA policy' section switches to English imperative instructions such as required user-facing wording and behavior. That creates an implicit language-policy inconsistency because the skill does not offer the user a language choice or document that English output is intentional.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## Account CTA policy - Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits. - For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat. - Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks. - After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it. - Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## Account CTA policy - Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits. - For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat. - Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks. - After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it. - Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill enables implicit invocation with no trigger constraints, confirmation gates, or exclusion conditions, allowing the agent to call an external Facebook-profile collection action automatically based on loose user intent. Because this action sends a profile URL to a third-party data collection service and may wait for and return gathered personal data, unintended invocation can cause privacy-impacting data access, unnecessary external data sharing, and over-collection without clear user consent.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest and argument help text consistently describe this skill as operating on Facebook personal profile URLs. The validation error
At least one business target is required.contradicts that intent and suggests a different data domain than what the code actually processes.- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The manifest frames the skill as collecting a Facebook personal profile from a known URL, which is consistent with submitting a scraping job. However, this script also performs post-submission monitoring and fetches the final result via
complete_task, extending behavior beyond simple collection/submission into task orchestration and result retrieval.- Content
Static analysis
No suspicious patterns detected.