Dataify Github Builder

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:07 AM UTC
• Version: 1.3.1

Overview

The skill's stated GitHub repository purpose is understandable, but its artifacts include broader scraping workflows and several scoping and credential-handling risks that warrant review before installation.

Install only if you are comfortable sending repository targets and task results through Dataify with your API token. Prefer a narrowed version that removes unrelated business/search/unlocker scripts, validates GitHub repository URLs, fixes the import path and curl quoting issues, and avoids putting reusable API tokens in URLs.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/wait_for_task.py:34

Finding

Dataify API Token Exposed in URL Query Parameters

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/catalog_builder.py:88

Finding

Shell Command Injection in Generated Curl Preview

Content

View full analysis

Remediation

View remediation

other

Note

• Location: scripts/catalog_builder.py:71

Finding

Repository Target Validation Does Not Enforce the Declared GitHub Scope

Content

View full analysis

Remediation

View remediation

T07 · Tool Hijacking and Spoofing

Warning

• Location: scripts/build-dataify-request.py:1

Finding

Unverified External Directory Can Override the Bundled Catalog Builder

Content

View full analysis

Remediation

View remediation

other

Note

• Location: scripts/business_workflow.py:25

Finding

Bundled Business Intelligence and Web-Unlocking Capabilities Exceed the Declared Skill Purpose

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (36)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The ability to monitor generic Dataify tasks and download generic JSON results is broader than the declared GitHub-repository-only purpose. If an agent can operate on arbitrary prior task IDs, the skill may become a general retrieval interface for external data unrelated to the stated use case.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The ability to monitor generic Dataify tasks and download generic JSON results is broader than the declared GitHub-repository-only purpose. If an agent can operate on arbitrary prior task IDs, the skill may become a general retrieval interface for external data unrelated to the stated use case.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The ability to monitor generic Dataify tasks and download generic JSON results is broader than the declared GitHub-repository-only purpose. If an agent can operate on arbitrary prior task IDs, the skill may become a general retrieval interface for external data unrelated to the stated use case.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The ability to monitor generic Dataify tasks and download generic JSON results is broader than the declared GitHub-repository-only purpose. If an agent can operate on arbitrary prior task IDs, the skill may become a general retrieval interface for external data unrelated to the stated use case.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The ability to monitor generic Dataify tasks and download generic JSON results is broader than the declared GitHub-repository-only purpose. If an agent can operate on arbitrary prior task IDs, the skill may become a general retrieval interface for external data unrelated to the stated use case.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The ability to monitor generic Dataify tasks and download generic JSON results is broader than the declared GitHub-repository-only purpose. If an agent can operate on arbitrary prior task IDs, the skill may become a general retrieval interface for external data unrelated to the stated use case.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

量，而不是只在当前终端临时设置。

Windows PowerShell，当前用户永久设置：

powershell

[Environment]::SetEnvironmentVariable("DATAIFY_API_TOKEN", "your_token_here", "User")

然后重新打开 PowerShell。如果当前会话也要立即生效，再执行：

powershell

$env:DATAIFY_API_TOKEN = "your_token_here"

macOS 或 Linux，bash 永久设置：

bash

echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.bashrc
source ~/.bashrc

macOS 或 Linux，zsh 永久设置：

bash

echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.zshrc
source ~/.zshrc

脚本用法

Python：

bash

python scripts/build-dataify-request.py --tool-sign <selected_tool_sign> --values-file values.json

PowerShell：

powershell

& ".\scripts\build-dataify-request.ps1" -ToolSign "<selected_tool_sign>" -ValuesFile ".\values.json"

values.json 可以是单个对象，也可以是对象数组。

输出格式

最终 curl 命令应为

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 50)May include surrounding context.

量，而不是只在当前终端临时设置。

Windows PowerShell，当前用户永久设置：

powershell

[Environment]::SetEnvironmentVariable("DATAIFY_API_TOKEN", "your_token_here", "User")

然后重新打开 PowerShell。如果当前会话也要立即生效，再执行：

powershell

$env:DATAIFY_API_TOKEN = "your_token_here"

macOS 或 Linux，bash 永久设置：

bash

echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.bashrc
source ~/.bashrc

macOS 或 Linux，zsh 永久设置：

bash

echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.zshrc
source ~/.zshrc

脚本用法

Python：

bash

python scripts/build-dataify-request.py --tool-sign <selected_tool_sign> --values-file values.json

PowerShell：

powershell

& ".\scripts\build-dataify-request.ps1" -ToolSign "<selected_tool_sign>" -ValuesFile ".\values.json"

values.json 可以是单个对象，也可以是对象数组。

输出格式

最终 curl 命令应为

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill metadata says it should collect structured GitHub repository information from known repository URLs only, but this file defines a generic business-intelligence workflow for price, review, lead, and brand monitoring. That mismatch indicates the skill can be repurposed to perform unrelated data collection and scraping far beyond user-expected scope, creating a capability overreach and policy-bypass risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The lead-generation logic targets LinkedIn and Crunchbase company pages, which is unrelated to GitHub repository enrichment. In the context of this skill, that constitutes unauthorized capability expansion into prospecting and external company profiling, increasing privacy, compliance, and misuse risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The command dispatcher includes shopping, review, Amazon, and Google Maps scraping capabilities that are unrelated to collecting repository information from known GitHub URLs. In this skill context, their presence materially increases the chance of misuse by enabling external scraping functions users would not expect or authorize.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The direct_request fallback sends search queries and arbitrary URLs to generic scraping endpoints, including a web unlocker for rendered HTML. For a repo-URL GitHub skill, this is dangerous because it provides a built-in path to broad network collection outside the advertised scope, potentially bypassing local package constraints and enabling covert capability escalation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The workflow extracts links from discovery results and automatically adds new detail-fetch actions for those URLs, enabling arbitrary external browsing. For a skill explicitly restricted to known repository URLs and not arbitrary webpages, this dynamic expansion is dangerous because it defeats the declared boundary and can silently broaden collection to unrelated sites.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The client exposes both a generic web search primitive and an arbitrary URL fetch/unlock primitive, which is materially broader than a skill that is supposed to operate only on known GitHub repository URLs. This expands the skill into a general browsing/scraping tool, enabling off-scope data access, policy bypass, and collection of content from arbitrary external sites if an attacker can influence inputs or orchestration.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The unlock() function accepts any public HTTP(S) URL and sends it to a remote page-unlocking service, with no restriction to GitHub repository pages. In a skill scoped to known GitHub repository URLs, this creates an unnecessary arbitrary external fetch capability that can be abused for broad content retrieval, evasion of simple access controls, and off-scope data collection.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares no explicit tool scope or permissions while its instructions clearly rely on environment access, file reads, shell usage, and outbound network calls. This increases the chance that a caller or agent executes broader capabilities than the metadata suggests, reducing policy enforcement and making misuse harder to contain.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The workflow asks the user to choose exactly one tool from a list that includes search-url and generic-url collection modes, directly contradicting the stated limitation to known repository URLs. This broadens the skill into search and arbitrary URL collection, increasing the likelihood of policy bypass and unintended data exfiltration to the external scraper service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instructions explicitly tell the user to choose exactly one tool from a Chinese list, and the listed options are presented only in Chinese. This imposes a language requirement without opt-in or an alternative locale, which is a natural-language policy violation under the language/locale rule.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

The skill instructs creation of a curl request that transmits user-supplied parameters and authenticated requests to an external service. Because the skill is framed narrowly but can select broader tools, the external transmission risk is more dangerous in context: users may unknowingly send non-repository targets or sensitive operational data to a third-party endpoint.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md

13. Set `spider_name` to `github.com`.
14. Set `spider_id` to the selected tool's `tool_sign`.
15. Always include `spider_errors=true` and `file_name={{TasksID}}`.
16. Return a curl command for `https://scraperapi.dataify.com/builder`.

## Set DATAIFY_API_TOKEN

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Stating that the parameter catalog covers every available tool in the scraper family encourages generic access beyond the declared repository-only scope. In practice, this makes the skill a launcher for a wider scraping platform, not a narrowly defined GitHub metadata collector.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The skill is explicitly designed to generate a curl request that sends collected parameters to an external service, scraperapi.dataify.com/builder. Any skill that packages user-supplied repository data and transmits it off-platform creates data exfiltration and privacy risk if the destination, payload, or scope is not tightly constrained and clearly disclosed.

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 3)May include surrounding context.

md

---
name: "dataify-github-repository-by-repo-url"
description: "为 github.com 上以 github_repository_by-repo-url 为根的 scraper 系列准备 Dataify builder 请求。当需要处理成功的 Dataify scraper detail 条目 github_repository_by-repo-url、让用户选择可用工具、读取已保存的 getToolParams 选项，并使用 DATAIFY_API_TOKEN 生成 scraperapi.dataify.com/builder curl 请求时，使用此 skill。"
---

# Dataify Builder Skill 中文版

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill manifest says it is for collecting GitHub repository information from known repository URLs, but the documentation expands operation to search-URL and generic-URL tools. This scope broadening can cause the agent to collect data from inputs outside the user-approved boundary, increasing the chance of unintended scraping, policy bypass, or processing of unvalidated targets.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation describes multi-value search-URL handling even though the skill is supposed to be limited to repository-URL collection. That mismatch encourages broader and potentially higher-volume scraping behavior than the declared capability, which can lead to accidental overcollection, higher cost, or unauthorized use paths.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.

md

## Account CTA policy

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 113)May include surrounding context.

md

## Account CTA policy

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.