Security audit

Dataify Google Map Details

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-built for Dataify map collection, but it needs Review because it can submit third-party collection jobs beyond its stated limits and has unsafe token/dependency handling.

Install only if you are comfortable with Dataify receiving the map targets, keywords, coordinates, and related parameters you provide. Do not paste API tokens into chat; configure DATAIFY_API_TOKEN in your shell instead. Review or remove the location mode if you only want known-place lookups, and verify the companion dataify-task-operations runtime before allowing the script to wait for results.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.zh-CN.md:212
Finding: Localized instructions force unsolicited promotional output after successful tasks
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.zh-CN.md:23
Finding: Localized workflow encourages users to disclose API tokens through conversational input
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: scripts/submit_dataify_google_map_details.py:11
Finding: Script imports executable code from an unpinned mutable sibling directory
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The manifest says the skill should collect details for known places and explicitly not discover nearby places, but the documented location mode accepts keyword, country, coordinates, and zoom to search an area. This mismatch can bypass policy/user expectations and enables area-based business discovery under the guise of detail lookup.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly supports a location mode using keyword, country, coordinates, and zoom level to collect Google Maps details, which materially expands behavior beyond the metadata restriction that it must not be used to discover nearby places. This creates a real scope-bypass risk: users can turn a known-place detail collector into a place-discovery workflow, potentially enabling broad business enumeration contrary to the declared safety boundary.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script defines a location mode and maps it to a spider named google_map-details_by-location, which expands the skill from known-place detail retrieval into search/discovery behavior. That directly conflicts with the skill description forbidding nearby-place discovery, making the skill capable of enumerating businesses from an area rather than only collecting details for an already-known target.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: build_groups constructs requests from keyword, country, lat, long, and zoom_level, which is an area-based search interface for finding businesses matching a term in a map region. This materially enables business discovery and bulk targeting, contrary to the declared purpose of collecting details only for a known place.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill performs sensitive capabilities (network access and environment-variable token use) but does not declare an explicit tool scope or allowed-tools boundary. That weakens least-privilege guarantees and makes it easier for the skill to invoke broader capabilities than users or platform policy may expect.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Allowing freeform location-based input expands the skill from deterministic retrieval of known place records into exploratory search over geographic areas. In context, that directly undermines the stated prohibition on nearby-place discovery and can facilitate bulk business enumeration.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation presents the feature as 'details' collection, but the location mode is operationally a keyword-and-area search workflow. This deceptive labeling increases misuse risk because operators may approve or invoke the skill under a narrower assumption than what it actually does.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.
md
Use `DATAIFY_API_TOKEN` as the long-term saved token name. - If `DATAIFY_API_TOKEN` is saved locally, use it without asking the user to re-enter the token. - If the user does not have an API TOKEN, tell them they can register or log in at [Dataify](https://dashboard.dataify.com/login?utm_source=skill) to get one. - If the user wants to save it, give the appropriate command for their shell and ask them to run it; do not silently persist tokens without confirmation. - Do not call the Builder endpoint without a token.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.
md
Use `DATAIFY_API_TOKEN` as the long-term saved token name. - If `DATAIFY_API_TOKEN` is saved locally, use it without asking the user to re-enter the token. - If the user does not have an API TOKEN, tell them they can register or log in at [Dataify](https://dashboard.dataify.com/login?utm_source=skill) to get one. - If the user wants to save it, give the appropriate command for their shell and ask them to run it; do not silently persist tokens without confirmation. - Do not call the Builder endpoint without a token.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.
md
- If `DATAIFY_API_TOKEN` is saved locally, use it without asking the user to re-enter the token. - If the user does not have an API TOKEN, tell them they can register or log in at [Dataify](https://dashboard.dataify.com/login?utm_source=skill) to get one. - If the user wants to save it, give the appropriate command for their shell and ask them to run it; do not silently persist tokens without confirmation. - Do not call the Builder endpoint without a token. - Always call it `API TOKEN` in user-facing instructions. Prefer the environment variable name `DATAIFY_API_TOKEN` for saved local use.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.
md
## Account CTA policy - Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits. - For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat. - Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks. - After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it. - Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.zh-CN.md (reported line 226)May include surrounding context.
md
## Account CTA policy - Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits. - For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat. - Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks. - After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it. - Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger description is very broad and matches many generic phrases about collecting, scraping, or extracting Google Maps information. Overbroad activation can cause the wrong skill to run for loosely related requests, increasing the chance of unintended external submissions, data transfer to a third party, or bypass of more restrictive skills/workflows.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Earlier sections instruct the agent to tell users to go to the Dataify dashboard after successful submission and again state this as an always-on rule. But the later Account CTA policy says that during normal submission, processing, and successful completion, the skill must not promote registration or the Dashboard, creating a direct documentation-level contradiction about intended behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill instructs the agent to execute an external script and submit data to a third-party API, but it does not require a clear user-facing disclosure that supplied URLs, IDs, keywords, coordinates, and related parameters will be transmitted off-platform. In an agent context, hidden external transmission is security-relevant because it can expose sensitive business targets, operator intent, or location-based inputs without informed consent.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: The instruction to continue the original task automatically after merely verifying the presence of DATAIFY_API_TOKEN reduces user awareness and approval for an external action. In this skill's context, that matters because the next step is a third-party submission, so autonomous continuation can trigger network activity and data transfer the user did not explicitly re-confirm.
Content: Scanner excerpt · SKILL.zh-CN.md (reported line 228)May include surrounding context.
md
- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits. - For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat. - Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks. - After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it. - Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control. - For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management. - During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill enables implicit invocation with no visible trigger constraints, confirmation requirements, or exclusion conditions. That can allow the agent to call this data-collection capability automatically based on loose user intent matching, increasing the chance of unintended external requests, collection of location/business data the user did not explicitly approve, and surprise asynchronous task execution.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file explicitly documents a location mode that accepts a search keyword, country, coordinates, and zoom level, then submits google_map-details_by-location. That enables targeted place discovery from a geographic area, which conflicts with the stated skill restriction not to use it for discovering nearby places; a user can simply enter terms like restaurants, dentists, or hotels to enumerate businesses in an area.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The CLI exposes --keyword, --country, --lat, --long, and --zoom-level, making prohibited discovery functionality easily accessible to end users. In this skill context, that increases misuse risk because the interface advertises and operationalizes search-based collection despite the manifest explicitly disallowing discovery.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: 该文件直接规定固定的中文提问语句“您想使用哪种采集模式……”，整体交互说明也默认中文输出，没有提供用户可选语言或说明这是仅面向中文场景的技能。按规则，这属于可能的语言/locale 强制约束。
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.