Security checks for vulnerabilities and agentic risk
Overview
The skill appears to perform the advertised flight-search API workflow, but it needs review because it handles a paid API token and includes unsafe persistent token setup guidance.
Review this before installing if you use a real Dataify account. Prefer a session-scoped DATAIFY_API_TOKEN or a secret manager, avoid putting the token in shell startup files or command-line arguments, and understand that flight routes, dates, passenger counts, filters, and API credits are sent to Dataify when live searches run.
The localized Skill instructions recommend storing the Dataify API token persistently in a user-level environment variable or directly in shell initialization files. In the macOS/Linux examples, the token is written as plaintext into .bashrc or .zshrc.
This persistence is not necessary for the declared flight-search functionality. A session-scoped environment variable is sufficient for executing an API request. The recommendation also conflicts with the safer policy in SKILL.md:80-84, which requires session-scoped setup to be shown first and discourages unnecessary persistent secret storage.
Shell initialization files may be exposed through local account compromise, overly permissive file permissions, workstation backups, support bundles, configuration synchronization, or accidental repository inclusion. User-level environment variables can similarly be accessed by processes running in the same user context.
This is classified as T09: Insecure Skill Coding Practices, rather than system persistence, because the persisted data is a credential and not an installed backdoor or startup execution hook.
Attack Path
A user follows the localized setup instructions.
The user replaces your_token_here with a valid Dataify API token.
The token is stored persistently in a shell profile or user environment.
A malicious process, another act
...[truncated 873 chars]
Remediation
View remediation
Remediation Suggestions
Remove the recommendation to store plaintext tokens in .bashrc, .zshrc, or persistent user environment variables.
Make session-scoped environment variables the default:
bash
export DATAIFY_API_TOKEN="..."
or:
powershell
$env:DATAIFY_API_TOKEN = "..."
For persistent storage, recommend an operating-system credential manager or secret-management facility instead of shell configuration files.
Keep the English and localized Skill instructions synchronized so both enforce the account CTA policy in SKILL.md.
Tell users never to paste tokens into chat, commit them to source control, include them in support logs, or place them in command history.
Document token rotation and revocation procedures for suspected exposure.
T09 · Insecure Skill Coding Practices
Warning
Location
scripts/google_flights.py:682
Finding
API Token Accepted Through a Command-Line Argument
Content
View full analysis
Vulnerability Details
File Location: scripts/google_flights.py:682 and scripts/google_flights.py:750-755 Vulnerability Type: Credential exposure through process arguments and shell history Risk Level: Medium
Vulnerable Code
python
parser.add_argument("--token", help="Dataify API token. Bearer prefix is optional.")
python
def get_authorization(token_arg: str | None) -> str | None:
token = clean_value(token_arg) or clean_value(os.environ.get("DATAIFY_API_TOKEN"))
if not token:
return None
if not token.lower().startswith("bearer "):
token = f"Bearer {token}"
os.environ["DATAIFY_API_TOKEN"] = token
return token
Technical Analysis
The script allows an API token to be supplied using the --token command-line option. Command-line secrets can be captured in shell history, terminal session logs, process-monitoring software, diagnostic reports, audit tooling, or process metadata visible to other local processes where operating-system policy permits it.
The command-line credential path is unnecessary because the script already supports DATAIFY_API_TOKEN. The implementation also copies the normalized bearer token into the process environment. Although this does not modify the parent shell or create cross-session persistence, it can unnecessarily broaden exposure to child processes if the program is later extended to launch subprocesses.
No evidence indicates that the script logs or transmits the token anywhere other than the fixed Dataify endpoint. The flaw is the insecure credential input channel, not an undisclosed exfiltration mechanism.
Attack Path
A user runs the script with a valid token, for example:
bash
The declared description says the skill searches Google Flights for fares and itineraries. However, this code chunk is an internal preview/inspection utility: it reads reference markdown files, infers defaults, parses JSON/CLI params, and prints a table of parameters. There is no flight-search logic, no network access, no Google Flights interaction, and no travel-specific behavior. This is a materially different primary purpose from the declared description, so it is a mismatch.
Content
No source excerpt is available for this finding.
Ae1
High
Category
analysis-evasion
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected
Content
Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.
md
with `python3`. Run it from this skill directory, or use the absolute path to `scripts/google_flights.py`.
Ae1
High
Category
analysis-evasion
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected
Content
Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.
md
with `python3`. Run it from this skill directory, or use the absolute path to `scripts/google_flights.py`.
Ae1
High
Category
analysis-evasion
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected
Content
Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.
md
with `python3`. Run it from this skill directory, or use the absolute path to `scripts/google_flights.py`.
始终使用 Content-Type: application/x-www-form-urlencoded 提交 API 请求。
保持请求值为字符串类型。
省略用户未请求的可选字段。
结果呈现
Undeclared Tool Scope
Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill invokes a Python script, reads reference files, checks environment variables, and ultimately performs outbound API requests, yet it declares no explicit tool scope or permission boundaries. This increases the chance that an agent platform will grant broader-than-intended access or that reviewers will underestimate the skill's capabilities, which is a real security governance issue even if the actions are expected for the workflow.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding
The instruction mandates exactly the Chinese column names 参数名, 当前值, 默认值, 说明 for output formatting. This is a language/locale constraint presented as unconditional behavior, and the file does not indicate user opt-in or a justified region-specific requirement.
Content
No source excerpt is available for this finding.
Vague Triggers
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
L03 将触发条件写为“搜索航班价格/行程”，这类表述接近日常自然请求，且未给出明确边界、限定上下文或反例。虽然“调用 Google Flights”较具体，但与宽泛短语并列后，整体触发范围仍偏模糊，可能匹配到普通对话中的航班咨询。
Content
No source excerpt is available for this finding.
Autonomous Decision Making
Medium
Category
Excessive Agency
Confidence
80% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content
Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.
md
## Account CTA policy
- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
Autonomous Decision Making
Medium
Category
Excessive Agency
Confidence
80% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content
Scanner excerpt · SKILL.zh-CN.md (reported line 80)May include surrounding context.
md
## Account CTA policy
- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
Autonomous Decision Making
Medium
Category
Excessive Agency
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content
Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.
md
- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
- For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management.
- During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.
Autonomous Decision Making
Medium
Category
Excessive Agency
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content
Scanner excerpt · SKILL.zh-CN.md (reported line 82)May include surrounding context.
md
- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
- For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management.
- During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding
The document instructs the skill to send an Authorization bearer token and user flight-search parameters to a third-party endpoint, but it provides no privacy notice, data-handling constraints, or user-consent guidance. In a travel-search skill, this means potentially sensitive itinerary and location data is transmitted off-platform without clear disclosure, creating privacy and compliance risk even if the API use is functionally intended.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding
The file hard-codes language aliases and later auto-detects a language from natural-language input to set the hl parameter. This can impose a locale choice implicitly rather than explicitly offering the user a language/locale selection, which matches the policy concern for forced language handling without opt-in.
Content
No source excerpt is available for this finding.
Context-Inappropriate Capability
Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding
The script reads the API token from DATAIFY_API_TOKEN and then writes the normalized bearer token back into the process environment. Persisting credentials in environment state beyond the immediate lookup broadens exposure to child processes, debugging output, crash dumps, or other code running in the same process, which exceeds the narrow needs of a flight-search helper.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding
The token-handling logic reads credentials from DATAIFY_API_TOKEN and rewrites the environment variable with a bearer-prefixed version without warning. Mutating credential-bearing environment variables can unintentionally expose secrets to subprocesses or unrelated components and is especially risky in shared agent runtimes.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding
The script sends user-supplied itinerary and passenger details to an external third-party API without an execution-time notice or confirmation. Travel dates, routes, passenger counts, and preferences can be sensitive personal data, and silent transmission increases the risk of unintended disclosure, especially in agent-mediated use where users may not realize a third party is involved.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding
The script prints all current parameter values directly to stdout in a Markdown table, with no masking or allow/deny list for sensitive fields. Even though it skips an exact field named 'Authorization' when discovering documented fields, user-supplied parameters passed via --params-json or unknown CLI args are still echoed verbatim, so secrets such as API keys, session tokens, or personal travel data could be exposed in terminal logs, CI logs, or chat transcripts.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Low
Category
Not specified by scanner
Confidence
84% confidence
Finding
The instruction maps language-related phrases directly to fixed hl locale values such as zh-cn and en, which can impose a language/locale choice rather than explicitly offering or confirming it with the user. The policy allows locale constraints when user choice or opt-in is explicit, which is not stated here.
Content
No source excerpt is available for this finding.
Intent-Code Divergence
Low
Category
Not specified by scanner
Confidence
83% confidence
Finding
The top-level docstring claims the script merely calls the Dataify Google Flights API and prints the raw response body, while the implementation includes substantial additional behavior such as parsing free-form requests, normalizing many fields, validating business rules, generating markdown/JSON dry-run previews, and handling credentials. This documentation understates and misrepresents what the code actually does, creating an intent-code divergence.
Content
No source excerpt is available for this finding.
Dynamic attribute access via getattr()
Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
Content
Scanner excerpt · scripts/google_flights.py (reported line 643)May include surrounding context.
python
params[normalized_key] = cleaned
for field in FIELDS:
value = clean_value(getattr(args, field))
if value is not None:
params[field] = value
Natural-Language Policy Violations
Low
Category
Not specified by scanner
Confidence
92% confidence
Finding
The script raises user-visible error messages only in Chinese for invalid JSON and type validation failures. This imposes a specific language on all users without opt-in or documented locale justification, which matches the language policy violation criteria.
