Dataify Play.google Builder

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:02 AM UTC
• Version: 1.3.1

Overview

This skill mostly matches a Dataify Google Play scraping workflow, but it has enough under-scoped and runtime-import risk that users should review it before installing.

Install only if you are comfortable sending the target URL, parameters, task metadata, and results to Dataify and using a Dataify API token. Prefer a session-scoped token, avoid storing it permanently in shell profiles unless needed, and review or patch the sys.path import behavior and URL validation before using this with paid or sensitive account credentials.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T07 · Tool Hijacking and Spoofing

Error

• Location: scripts/build-dataify-request.py:5

Finding

External Python Module Shadowing Enables Execution of Untrusted Sibling Code

Content

View full analysis

Vulnerability Details

File Location: scripts/build-dataify-request.py:5-9
Vulnerability Type: Python import-path hijacking and tool spoofing
Risk Level: High

Vulnerable Code

python

TASK_RUNTIME_DIR = os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "dataify-task-operations", "scripts"))
if TASK_RUNTIME_DIR not in sys.path:
    sys.path.insert(0, TASK_RUNTIME_DIR)

from catalog_builder import build_curl, run_catalog_builder

Technical Analysis

The entry point inserts an external sibling directory at index zero of sys.path before importing catalog_builder. Python searches index zero before the directory containing the packaged implementation. If the sibling directory exists and contains a module named catalog_builder.py, that module takes precedence over the audited local file at scripts/catalog_builder.py.

Importing a Python module executes its top-level code. Therefore, a malicious or compromised sibling module can execute code as soon as the documented Skill entry point starts. The imported module also controls run_catalog_builder, allowing it to replace the entire task-submission workflow.

This is particularly sensitive because the process inherits DATAIFY_API_TOKEN. A substituted module could read that credential, modify task parameters, submit unauthorized paid requests, forge returned results, or perform arbitrary operations permitted to the user running the Skill.

The external executable precedence is not documented in the declared Skill workflow, and the local audited catalog_builder.py is not guaranteed to be the implementation used at runtime.

Attack Path

1. An attacker gains the ability to create or modify the expected sibling directory dataify-task-operations/scripts.
2. The attacker places a malicious catalog_builder.py in that directory.
3. A user invokes the documented scripts/build-dataify-request.py entry point with `DATAIFY_AP ...[truncated 1153 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the external sys.path modification and import the packaged implementation directly.
2. Place shared functionality in a uniquely named, properly packaged Python module rather than importing a generic module name from a sibling directory.
3. If an external dependency is unavoidable:
   • Pin its exact version and integrity hash.
   • Install it through a controlled dependency mechanism.
   • Import it through an unambiguous package namespace.
   • Verify the resolved module path before executing any imported functionality.
4. Do not prepend writable or externally managed directories to sys.path.
5. Add a regression test that checks catalog_builder.__file__ resolves inside the current Skill package.
6. Run the Skill with a restricted environment and avoid exposing credentials to modules that do not require them.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/wait_for_task.py:34

Finding

Dataify API Token Is Transmitted in URL Query Strings

Content

View full analysis

Vulnerability Details

File Location: scripts/wait_for_task.py:34-39, scripts/wait_for_task.py:103-108, and scripts/wait_for_task.py:128-133
Vulnerability Type: Sensitive credential exposure through request URLs
Risk Level: Medium

Vulnerable Code

python

def request_json(endpoint, params, api_key, timeout):
    url = endpoint + "?" + urllib.parse.urlencode(params)
    request = urllib.request.Request(url, method="GET")
    try:
        with urllib.request.urlopen(request, timeout=timeout) as response:

The status request supplies the token as an api_key query parameter:

python

payload = request_json(
    STATUS_ENDPOINT,
    {"api_key": api_key, "task_id": task_id},
    api_key,
    request_timeout,
)

The download request uses the same pattern:

python

return request_json(
    DOWNLOAD_ENDPOINT,
    {"api_key": api_key, "task_id": task_id, "type": "json"},
    api_key,
    request_timeout,
)

Technical Analysis

The API token is encoded directly into the URL of every task-status and result-download request. HTTPS protects the URL while it is in transit, but it does not prevent the receiving service or intermediate trusted infrastructure from recording the request URI.

Query strings are routinely captured by:

• Web-server and reverse-proxy access logs.
• API gateway telemetry.
• Application performance monitoring systems.
• Error reports and diagnostic traces.
• Network debugging tools.
• Request history retained by infrastructure components.

The function replaces token occurrences in the response body before parsing it, but this does not redact the outgoing request URL or any server-side and infrastructure logs created from that URL.

Polling amplifies exposure because the same token-bearing URL is generated repeatedly until the task completes.

Attack Path

1. A user configures DATAIFY_API_TOKEN and submits a Dataify ...[truncated 1150 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove api_key from all query-string parameter dictionaries.

2. Send the credential through an authorization header, preferably:

   python

   request = urllib.request.Request(
       url,
       headers={"Authorization": "Bearer {}".format(api_key)},
       method="GET",
   )
   

3. Keep only non-sensitive values such as task_id and type in the query string, or move them to a request body if the API supports POST.

4. Coordinate the authentication change with the Dataify API contract if the existing endpoint currently requires api_key.

5. Configure server, proxy, and application telemetry to redact authorization headers.

6. Avoid logging constructed request objects or complete URLs when sensitive parameters could be present.

7. Rotate tokens that may already have been exposed through URL logs.

8. Add automated tests that assert the literal token never appears in a generated status or download URL.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/catalog_builder.py:53

Finding

Missing Parameter Schema Allows Requests Outside the Declared Google Play URL Scope

Content

View full analysis

Vulnerability Details

File Location: references/tool-params.json:1 and scripts/catalog_builder.py:53-83
Vulnerability Type: Missing input schema, unknown-parameter acceptance, and insufficient target validation
Risk Level: Medium

Vulnerable Code

The catalog declares both tools with empty parameter definitions:

json

[
  {
    "tool_name_cn": "应用评论URL",
    "tool_sign": "google-play-store_reviews_by-url",
    "spider_name": "play.google.com",
    "params": []
  },
  {
    "tool_name_cn": "应用信息URL",
    "tool_sign": "google-play-store_information_by-url",
    "spider_name": "play.google.com",
    "params": []
  }
]

Unknown request fields are preserved:

python

def map_select_labels(tool, rows):
    definitions = {item["param"]: item for item in tool.get("params", [])}
    normalized = []
    for row in rows:
        mapped = {}
        for key, value in row.items():
            definition = definitions.get(key, {})
            final = value
            if definition.get("input_mode") == "select":
                for option in definition.get("options", []):
                    if value in {option.get("label"), option.get("submitted_value"), option.get("raw_value"), option.get("raw_type_value")}:
                        final = option.get("submitted_value")
                        break
            mapped[key] = final
        normalized.append(mapped)
    return normalized

Validation applies only to fields defined in the empty catalog schema:

python

def validate_required(tool, rows):
    definitions = {item["param"]: item for item in tool.get("params", [])}
    required = [key for key, item in definitions.items() if item.get("required") is True]
    for index, row in enumerate(rows, 1):
        missing = [key for key in required if row.get(key) in (None, "", [])]
        if missing:
            examples = [definitions[key].ge
...[truncated 3094 chars]

Remediation

View remediation

Remediation Suggestions

1. Define the documented parameter explicitly in each catalog entry, including at least:
   • Parameter name: url.
   • Required status: true.
   • Format: url.
   • Expected input mode.
   • A valid Google Play example.
2. Reject fields that are not present in the selected tool's parameter schema.
3. Require the URL scheme to be https.
4. Normalize the hostname and enforce an exact allowlist containing play.google.com; do not use substring matching.
5. Reject URLs containing embedded usernames or passwords.
6. Validate the expected path, such as /store/apps/details.
7. Require and validate the Google Play application identifier in the query parameters.
8. Reject empty parameter objects and ambiguous multi-row inputs before submission.
9. Add tests covering:
   • Missing url.
   • Unknown fields.
   • Non-URL values.
   • HTTP instead of HTTPS.
   • Lookalike domains.
   • Credential-bearing URLs.
   • Unrelated paths on play.google.com.
10. Retain server-side validation as defense in depth rather than relying on it as the sole scope boundary.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (30)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The file documents generic Dataify task monitoring and output download behavior rather than a narrowly bounded Google Play URL processor. This mismatch can mislead users and policy systems into granting trust or permissions to a broader task-management skill under a narrower label.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The file documents generic Dataify task monitoring and output download behavior rather than a narrowly bounded Google Play URL processor. This mismatch can mislead users and policy systems into granting trust or permissions to a broader task-management skill under a narrower label.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The file documents generic Dataify task monitoring and output download behavior rather than a narrowly bounded Google Play URL processor. This mismatch can mislead users and policy systems into granting trust or permissions to a broader task-management skill under a narrower label.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The file documents generic Dataify task monitoring and output download behavior rather than a narrowly bounded Google Play URL processor. This mismatch can mislead users and policy systems into granting trust or permissions to a broader task-management skill under a narrower label.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The file documents generic Dataify task monitoring and output download behavior rather than a narrowly bounded Google Play URL processor. This mismatch can mislead users and policy systems into granting trust or permissions to a broader task-management skill under a narrower label.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The file documents generic Dataify task monitoring and output download behavior rather than a narrowly bounded Google Play URL processor. This mismatch can mislead users and policy systems into granting trust or permissions to a broader task-management skill under a narrower label.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The file documents generic Dataify task monitoring and output download behavior rather than a narrowly bounded Google Play URL processor. This mismatch can mislead users and policy systems into granting trust or permissions to a broader task-management skill under a narrower label.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

量，而不是只在当前终端临时设置。

Windows PowerShell，当前用户永久设置：

powershell

[Environment]::SetEnvironmentVariable("DATAIFY_API_TOKEN", "your_token_here", "User")

然后重新打开 PowerShell。如果当前会话也要立即生效，再执行：

powershell

$env:DATAIFY_API_TOKEN = "your_token_here"

macOS 或 Linux，bash 永久设置：

bash

echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.bashrc
source ~/.bashrc

macOS 或 Linux，zsh 永久设置：

bash

echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.zshrc
source ~/.zshrc

脚本用法

Python：

bash

python scripts/build-dataify-request.py --tool-sign <selected_tool_sign> --values-file values.json

PowerShell：

powershell

& ".\scripts\build-dataify-request.ps1" -ToolSign "<selected_tool_sign>" -ValuesFile ".\values.json"

values.json 可以是单个对象，也可以是对象数组。

输出格式

最终 curl 命令应为

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 47)May include surrounding context.

量，而不是只在当前终端临时设置。

Windows PowerShell，当前用户永久设置：

powershell

[Environment]::SetEnvironmentVariable("DATAIFY_API_TOKEN", "your_token_here", "User")

然后重新打开 PowerShell。如果当前会话也要立即生效，再执行：

powershell

$env:DATAIFY_API_TOKEN = "your_token_here"

macOS 或 Linux，bash 永久设置：

bash

echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.bashrc
source ~/.bashrc

macOS 或 Linux，zsh 永久设置：

bash

echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.zshrc
source ~/.zshrc

脚本用法

Python：

bash

python scripts/build-dataify-request.py --tool-sign <selected_tool_sign> --values-file values.json

PowerShell：

powershell

& ".\scripts\build-dataify-request.ps1" -ToolSign "<selected_tool_sign>" -ValuesFile ".\values.json"

values.json 可以是单个对象，也可以是对象数组。

输出格式

最终 curl 命令应为

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill is supposed to collect Google Play reviews from a known Play Store app URL, but this shared workflow exposes generic search discovery, arbitrary source URLs, and review collection from broad web sources. That scope expansion enables use for app discovery, rankings, general search, and collection from unrelated sites, violating least privilege and creating a capability mismatch that can be abused for broader scraping than the skill declares.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file contains routing for unrelated capabilities including price intelligence, lead intelligence, brand monitoring, Google News/Search/Shopping, Amazon comments, Google Maps reviews, and a generic web unlocker. In the context of a narrowly described Google Play review skill, bundling these extra capabilities materially increases attack surface and allows repurposing the skill for unauthorized collection tasks beyond its declared function.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The client exposes broad search() and unlock() primitives that can query Google generally and fetch arbitrary public URLs, which exceeds the skill’s declared purpose of collecting reviews from a known Google Play app URL. In an agent setting, this materially expands the skill’s capabilities into general web access, enabling misuse for discovery, arbitrary content retrieval, and policy bypass outside the intended workflow.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The search() function performs unrestricted Google SERP queries based on arbitrary input, which is unnecessary for a skill explicitly scoped to a known Play Store URL. This broadens the tool into a general discovery mechanism and can be leveraged to locate unintended targets, defeating the narrow-scope safety expectations of the skill.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill declares no explicit tool/permission boundaries while its documented workflow relies on environment access, file reads, shell commands, and outbound network requests. In an agent setting, missing scope declarations increase the chance the skill can be invoked with broader capabilities than users expect, which weakens least-privilege controls.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The workflow tells the user to choose from multiple tools, including app information collection, which directly broadens the skill beyond review collection. This undermines the declared scope and enables data collection modes that the metadata says should not be part of the skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The workflow says to ask the user to choose from a Chinese list, and the listed tool names are presented only in Chinese-context wording. This imposes a specific language/locale on the interaction without user opt-in or a documented region-specific need, which matches the language policy violation criteria.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The skill instructs sending collected parameters and target URLs to an external third-party endpoint. External transmission is expected for a scraping integration, but it is still security-relevant because user-supplied inputs and potentially sensitive task metadata leave the local trust boundary.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md

13. Set `spider_name` to `play.google.com`.
14. Set `spider_id` to the selected tool's `tool_sign`.
15. Always include `spider_errors=true` and `file_name={{TasksID}}`.
16. Return a curl command for `https://scraperapi.dataify.com/builder`.

## Set DATAIFY_API_TOKEN

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The skill is explicitly designed to construct requests to an external service using a bearer token and user-supplied parameters, which creates a real data-transmission boundary. In context this is expected functionality, but it is still security-relevant because sensitive inputs, app URLs, and scraping parameters may be sent to a third party if the user or agent uses the skill.

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 3)May include surrounding context.

md

---
name: "dataify-google-play-store-reviews-by-url"
description: "为 play.google.com 上以 google-play-store_reviews_by-url 为根的 scraper 系列准备 Dataify builder 请求。当需要处理成功的 Dataify scraper detail 条目 google-play-store_reviews_by-url、让用户选择可用工具、读取已保存的 getToolParams 选项，并使用 DATAIFY_API_TOKEN 生成 scraperapi.dataify.com/builder curl 请求时，使用此 skill。"
---

# Dataify Builder Skill 中文版

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The instructions require the user to choose from a '中文工具列表' and match against a Chinese tool name, which imposes a specific language context rather than offering a language choice. This is a natural-language locale policy issue because the file does not indicate that Chinese is optional or that the user may interact in another language.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

md

## Account CTA policy

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 110)May include surrounding context.

md

## Account CTA policy

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.

md

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
- For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management.
- During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 112)May include surrounding context.

md

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
- For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management.
- During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The interface metadata and default prompt broaden the capability from the declared purpose of collecting Google Play reviews from a known app URL to generic 'Play.google Builder data' collection. This mismatch can mislead users or downstream agents into invoking the skill for unsupported or broader scraping tasks, weakening policy boundaries and increasing the chance of unintended data collection or misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The fallback path posts search queries and target URLs to remote endpoints at scraperapi.dataify.com and webunlocker.dataify.com, which transmits user-provided business subjects and source URLs off-host. While the code checks for an API token, it does not provide a user-facing warning at the point of transmission via prompt, print/log statement, or explanatory comment/docstring about this data being sent to external services.

Content

No source excerpt is available for this finding.