dataify-google-maps-reviews

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:06 AM UTC
• Version: 1.3.0

Overview

The skill does the advertised review collection, but it handles API credentials in risky ways and loads an unbundled local runtime that receives the token.

Review before installing. Use only a session-scoped environment variable or a secret manager for DATAIFY_API_TOKEN, avoid passing the token on the command line or in chat, and make sure the companion dataify-task-operations runtime is trusted and reviewed before using result-waiting behavior.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T07 · Tool Hijacking and Spoofing

Error

• Location: scripts/google_maps_reviews.py:16

Finding

Untrusted External Runtime Import Enables Arbitrary Code Execution and Token Theft

Content

View full analysis

Vulnerability Details

File Location: scripts/google_maps_reviews.py:16-19 and scripts/google_maps_reviews.py:190-195
Vulnerability Type: Untrusted local module loading and tool spoofing
Risk Level: High

Vulnerable Code

python

TASK_RUNTIME_DIR = os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "dataify-task-operations", "scripts"))
if TASK_RUNTIME_DIR not in sys.path:
    sys.path.insert(0, TASK_RUNTIME_DIR)
from task_runtime import complete_task, extract_task_id

The imported function is subsequently given the API credential:

python

try:
    final_result = complete_task(task_id, token, args.wait_timeout, args.timeout)
except RuntimeError as exc:
    print(str(exc), file=sys.stderr)
    return 1

Technical Analysis

The script constructs a path outside the audited Skill package and inserts it at the beginning of sys.path. Python then imports task_runtime from that externally controlled location. The referenced module is not included in the audited project, so its implementation, integrity, provenance, and network behavior cannot be verified.

Prepending the directory gives it import priority. Any process or user able to create or replace ../../dataify-task-operations/scripts/task_runtime.py can cause attacker-controlled Python code to execute automatically when the legitimate script starts. The imported complete_task function is also passed the normalized bearer token, task identifier, and timeout values, providing a direct credential-disclosure opportunity.

This external runtime is relevant to asynchronous result collection, but importing an unverified sibling module with execution privileges and giving it the raw credential exceeds the minimum trust boundary needed for the declared functionality.

Attack Path

1. An attacker gains write access to the expected sibling path, or causes the Skill to run in a directory layout containing an atta ...[truncated 1234 chars]

Remediation

View remediation

Remediation Suggestions

1. Bundle the required task-runtime implementation inside the audited Skill package and import it through a package-relative import.
2. Alternatively, use a version-pinned, integrity-verified dependency installed from a trusted package source.
3. Do not prepend writable or externally managed directories to sys.path.
4. If an external runtime is unavoidable, resolve a fixed file path and verify its cryptographic digest or signature before loading it.
5. Apply restrictive ownership and write permissions to all runtime code directories.
6. Reduce credential exposure by keeping authentication inside a small, audited client component instead of passing the raw bearer token into externally loaded functions.
7. Add startup validation that rejects symlinks, unexpected ownership, or group/world-writable runtime files.
8. Include the runtime in future security-audit scope and test import resolution in the actual deployment layout.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.zh-CN.md:49

Finding

Plaintext and Command-Line API Token Handling Exposes Credentials

Content

View full analysis

Vulnerability Details

File Location: SKILL.zh-CN.md:49-75, scripts/google_maps_reviews.py:53, and scripts/google_maps_reviews.py:129-134
Vulnerability Type: Plaintext sensitive-data storage and command-line credential exposure
Risk Level: Medium

Vulnerable Code

The documentation recommends permanently writing the API token into shell startup files:

powershell

[Environment]::SetEnvironmentVariable("DATAIFY_API_TOKEN", "your_token_here", "User")

powershell

$env:DATAIFY_API_TOKEN = "your_token_here"

bash

echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.bashrc
source ~/.bashrc

bash

echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.zshrc
source ~/.zshrc

The executable also accepts the secret directly as a command-line argument and falls back to the environment:

python

parser.add_argument("--token", help="Dataify API token. Bearer prefix is optional.")

python

def normalize_token(token: str | None) -> str:
    token = clean_value(token) or clean_value(os.environ.get("DATAIFY_API_TOKEN"))
    if not token:
        raise SystemExit(TOKEN_MISSING_MESSAGE)
    if token.lower().startswith("bearer "):
        return token
    return f"Bearer {token}"

Technical Analysis

Passing a token through --token can expose it in shell history, process listings, command telemetry, diagnostic reports, terminal logs, and automation logs. Permanently appending the token to .bashrc or .zshrc stores it as plaintext in a commonly read and backed-up file. A user-scoped persistent Windows environment variable similarly broadens the duration and process scope of credential exposure.

The Chinese documentation explicitly recommends persistent storage, while the later account policy says to show session-scoped setup first and not ask users to paste tokens into chat. These contradictory instructions make insecure persistence more l ...[truncated 1367 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the --token command-line option so credentials cannot be supplied through process arguments.
2. Accept credentials through a protected OS credential manager, a secure secret-injection facility, or non-echoing standard input.
3. If environment variables must be supported, recommend session-scoped variables by default and explain their exposure limitations.
4. Remove instructions that append plaintext tokens to .bashrc or .zshrc.
5. Do not recommend persistent user environment variables as the primary Windows setup mechanism.
6. If persistent storage is required, direct users to an operating-system credential store and document restrictive access controls.
7. Ensure scripts and error handlers never print the token or include authorization headers in logs.
8. Harmonize both language versions of the Skill documentation so they consistently prohibit sharing tokens in chat and prioritize session-scoped or protected storage.
9. Document token revocation and rotation procedures for suspected exposure.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Tainted flow: 'request' from os.environ.get (line 153, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/google_maps_reviews.py (reported line 164)May include surrounding context.

python

},
    )
    try:
        with urllib.request.urlopen(request, timeout=timeout) as response:
            return response.read().decode("utf-8", errors="replace")
    except urllib.error.HTTPError as exc:
        body = exc.read().decode("utf-8", errors="replace")

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 67)May include surrounding context.

量，而不是只在当前终端临时设置。

Windows PowerShell，当前用户永久设置：

powershell

[Environment]::SetEnvironmentVariable("DATAIFY_API_TOKEN", "your_token_here", "User")

然后重新打开 PowerShell。如果当前会话也要立即生效，再执行：

powershell

$env:DATAIFY_API_TOKEN = "your_token_here"

macOS 或 Linux，bash 永久设置：

bash

echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.bashrc
source ~/.bashrc

macOS 或 Linux，zsh 永久设置：

bash

echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.zshrc
source ~/.zshrc

核心工作流程

1. 从用户请求中识别采集模式。
2. 提交前，以 Markdown 表格展示必填参数、可选参数和默认值。
3. 规范化并验证最终参数值。
4. 获取 Dataify token（用户提供或已保存的 DATAIFY_API_TOKEN）。
5. 如果没有 token，提示用户前往 Dataify 获取。
6. 提

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

md

## Account CTA policy

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 113)May include surrounding context.

md

## Account CTA policy

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

md

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
- For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management.
- During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 115)May include surrounding context.

md

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
- For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management.
- During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document title explicitly declares this as a Chinese version, and the operational instructions throughout the file are written entirely in Chinese without any opt-in or user language choice. Under the policy rule, forcing a specific language is a natural-language policy violation unless the skill offers a choice or clearly documents a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill contains contradictory token-handling guidance: it says a user-provided token in the request should be used, while later stating the user should never be asked to paste the token into chat. This creates a real secret-handling risk because it normalizes transmitting API credentials through conversational input, which may be logged, retained, or exposed to unintended parties.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.