Security audit
Security checks for vulnerabilities and agentic risk
This skill appears non-destructive, but its advertised Google Maps search scope conflicts with its actual Place ID/CID and place-detail capabilities.
Review before installing. Use it only if you are comfortable sending Google Maps searches, coordinates, and place identifiers to Dataify with your API token. Avoid Place ID/CID detail workflows unless the publisher clarifies the advertised scope, and configure the token through an environment variable rather than pasting it into chat.
The skill metadata says it should not be used when a known URL, CID, or Place ID is needed, yet the body explicitly supports place_id, data_cid, and place-style lookups through a third-party scraping API. This mismatch can mislead operators and policy layers into invoking the skill in contexts they intended to exclude, weakening security review and creating unexpected data flows to an external service.
The skill metadata says it should not be used when a known URL, CID, or Place ID is needed, yet the body explicitly supports place_id, data_cid, and place-style lookups through a third-party scraping API. This mismatch can mislead operators and policy layers into invoking the skill in contexts they intended to exclude, weakening security review and creating unexpected data flows to an external service.
Without declared permissions the skill's intent is opaque and cannot be validated.
L045-L048 says to use an exact table shape beginning with a confirmation prompt asking the user to confirm parameter changes before calling the API. Later, L150-L153 explicitly says clear read-only requests should execute immediately without pausing for confirmation and that fixed/default/internal fields should never be shown. These instructions actively conflict about whether confirmation is mandatory and whether a full parameter table should be displayed.
L045 says to use the exact table shape including every body field, and L052-L070 enumerate all fields regardless of whether they are relevant. But L152-L154 says confirmation views should show only consequential user-facing values and must never show fixed fields, empty optional fields, unchanged defaults, or internal parameters. This is a direct contradiction in the skill's own documentation about how parameters should be presented.
The markdown instructs the agent to use an exact confirmation block beginning with Chinese text, which imposes a specific language on the interaction regardless of the user's language. This is a natural-language policy issue because no user choice or locale-based justification is provided.
Lines L045-L049 instruct the agent to present a confirmation table and wait for user confirmation before calling the API. Later, L144-L149 says low-risk read-only requests should execute directly without pausing for confirmation and that full parameter tables should be avoided unless truly necessary. These directions are in active conflict about whether the skill should block on confirmation.
This file is a zh-CN skill document, but the 'Account CTA policy' section is written in English and prescribes fixed English wording such as 'New accounts receive 50 free credits.' The instructions do not state that the language should follow the user's preference or provide an opt-in choice, which can violate a language/locale policy requiring user-selected language behavior.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
## Account CTA policy
- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
## Account CTA policy
- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
- For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management.
- During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
- For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management.
- During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.
The instructions say to show a pre-call table before every real API call, and the provided required column headers are only in Chinese. This imposes a specific language on all users without opt-in or an alternative locale, which violates the language/locale policy criteria.
This code includes a mandatory user-facing error message entirely in Chinese when the API token is missing. Because the skill is not clearly documented as China-specific or otherwise locale-constrained, this enforces a specific language without user opt-in, which matches the language/locale policy violation criteria.
The code explicitly accepts place_id and data_cid inputs and later supports type=place requests, which conflicts with the skill's declared scope of search-only usage. In an agent setting, this capability expansion can bypass policy or routing expectations and let callers retrieve structured place-detail data the skill metadata says should not be handled here.
Natural-language parsing automatically maps requests mentioning 'details' to type=place, broadening the tool from simple map search into place-detail retrieval. In an agent ecosystem, this kind of implicit mode switching can cause the agent to perform actions outside the advertised capability boundary, undermining safety and review assumptions.
The module docstring states "Call Dataify Scraper API Google Maps," and the argparse description says "Call Dataify Google Maps API," which suggests a direct Google Maps API integration. In reality, the code sends a POST request to https://scraperapi.dataify.com/request with engine=google_maps, meaning it uses Dataify's scraping endpoint rather than a Google Maps API.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
params[key] = cleaned
for field in FIELDS:
value = clean_value(getattr(args, field))
if value is not None:
params[field] = value
This code emits error messages only in Chinese for invalid --params-json input. The policy for natural-language content prohibits forcing a specific language or locale unless the user is given a choice or the constraint is clearly justified.