Dataify Google Search

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:08 AM UTC
• Version: 1.3.0

Overview

The skill is a coherent Dataify Google search wrapper, but users should review it because some credential setup and handling paths can expose or persist the API token.

Install only if you are comfortable sending search queries to Dataify and using a Dataify API token. Prefer a session-scoped environment variable or a credential manager, avoid passing the token with --token, and do not follow instructions that append the token to shell startup files unless you understand the persistence risk.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.zh-CN.md:21

Finding

Persistent Plaintext Storage of the Dataify API Token

Content

View full analysis

> ~/.bashrc source ~/.bashrc ``` ```bash echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.zshrc source ~/.zshrc ``` ### Technical Analysis The localized Skill instructions recommend permanently storing the Dataify API token in a user environment variable or plaintext shell startup file. On Unix-like systems, the commands append the credential directly to `.bashrc` or `.zshrc`. On Windows, the credential is stored as a persistent user-level environment variable. This exceeds the minimum persistence required to execute a search request. A session-scoped environment variable would be sufficient. The recommendation also conflicts with the later account policy, which directs the Agent to present a session-scoped setup command first and only discuss persistent configuration when requested. Shell configuration files may be copied into backups, synchronized through dotfile repositories, included in support archives, or read by other processes operating under the same account. Persisted environment variables are inherited by subsequently launched processes and may appear in diagnostic data. ### Attack Path 1. A user follows the documented persistent setup instructions. 2. The Dataify token is written in plaintext to a shell startup file or user environment configuration. 3. A local process, backup recipient, support bundle, dotfile synchronization service, or attacker with access to the user account obtains the stored value. 4. The token is used to authenticate to Dataify and consume the victim's API credits or perform requests under the victim's account. ### Impact Assessment This issue does not grant operat ...[truncated 295 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/google_search.py:111

Finding

API Token Exposure Through Command-Line Arguments and Environment Mutation

Content

View full analysis

str | None: token = clean_value(token_arg) or clean_value(os.environ.get("DATAIFY_API_TOKEN")) if not token: return None if not token.lower().startswith("bearer "): token = f"Bearer {token}" os.environ["DATAIFY_API_TOKEN"] = token return token ``` ### Technical Analysis The script accepts a reusable API credential through the `--token` command-line option. Command-line arguments can be retained in shell history, command telemetry, process-monitoring records, debugging output, and automation logs. Depending on the operating system and process visibility configuration, another local user or monitoring process may also be able to inspect the running process arguments. The function then writes the normalized authorization value back into `os.environ`. This mutation is unnecessary because the value is already available locally and can be passed directly to the HTTP request. It broadens exposure to any child process subsequently launched by the program or by code imported into it. It also changes the variable from a raw token into a `Bearer `-prefixed value, which can cause inconsistent behavior for consumers expecting the original format. Although the current script does not launch child processes, avoiding unnecessary propagation is part of least-privilege credential handling and reduces risk from future maintenance changes. ### Attack Path 1. A user or automation system invokes the script with `--token` followed by a valid Dataify token. 2. The complete token is recorded in shell history, process arguments, command telemetry, or task logs. 3. A local observer, log reader, monito ...[truncated 674 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/google_search.py:363

Finding

Authorization Header May Be Forwarded Across HTTP Redirects

Content

View full analysis

int: body = urllib.parse.urlencode(params).encode("utf-8") request = urllib.request.Request( API_URL, data=body, headers={ "Authorization": authorization, "Content-Type": "application/x-www-form-urlencoded", "Accept": "*/*", }, method="POST", ) try: with urllib.request.urlopen(request, timeout=timeout) as response: sys.stdout.buffer.write(response.read()) return 0 ``` ### Technical Analysis The request includes the reusable Dataify credential in the `Authorization` header and is submitted with the default `urllib.request` opener. The implementation does not disable redirects, verify that a redirect remains on the approved HTTPS origin, or explicitly strip authorization data when the destination origin changes. If the Dataify endpoint, its infrastructure, or an intermediary returns a redirect to an unexpected host, automatic redirect processing can create a path for the sensitive header to be forwarded outside the intended trust boundary. The endpoint is hardcoded and uses HTTPS, which reduces ordinary exposure, so exploitation generally requires endpoint compromise, infrastructure misconfiguration, or an unexpected server-side redirect. The network request itself is necessary for the Skill's declared functionality. The weakness is the absence of an explicit credential-preserving redirect policy, not the use of the Dataify API. ### Attack Path 1. The script sends a request containing the Dataify token to the configured HTTPS endpoint. 2. The endpoint or an intermediary is compromised or misconfigured and responds with a redirect to another ori ...[truncated 757 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared purpose says this skill performs a Google web search, but the analyzed behavior indicates additional local parsing/inspection behavior and possibly no actual search execution. This mismatch is dangerous because users and policy systems may authorize the skill under false assumptions, while the implementation can access local files or process inputs in ways outside the advertised scope.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 40)May include surrounding context.

量，而不是只在当前终端临时设置。

Windows PowerShell，当前用户永久设置：

powershell

[Environment]::SetEnvironmentVariable("DATAIFY_API_TOKEN", "your_token_here", "User")

然后重新打开 PowerShell。如果当前会话也要立即生效，再执行：

powershell

$env:DATAIFY_API_TOKEN = "your_token_here"

macOS 或 Linux，bash 永久设置：

bash

echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.bashrc
source ~/.bashrc

macOS 或 Linux，zsh 永久设置：

bash

echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.zshrc
source ~/.zshrc

参考文件

• references/ 目录下的 API 文档包含完整的字段列表和说明。
• 当字段行为、允许的值或响应格式不明确时，请查阅参考文档。

注意事项

• 始终使用 Content-Type: application/x-www-form-urlencoded 提交 API 请求。
• 保持请求值为字符串类型。
• 省略用户未请求的可选字段。

结果呈现

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill appears to require environment access, local file reads, and network access, but it does not declare any explicit tool scope or permissions. This weakens least-privilege controls and can cause the agent to run with broader capabilities than users or the platform expect, increasing the blast radius if the skill is misused or modified.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

md

## Account CTA policy

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 80)May include surrounding context.

md

## Account CTA policy

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
- For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management.
- During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 82)May include surrounding context.

md

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
- For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management.
- During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script sends user search queries and related parameters to the third-party Dataify Scraper API, but it does not provide any runtime disclosure or consent prompt before transmitting potentially sensitive user input. In a skill context, users may assume a local Google search wrapper while their data is actually relayed to an external service, creating privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document mixes English headings with Chinese-only parameter descriptions such as '固定使用 google 搜索引擎' and other field explanations, which effectively imposes a specific language on readers. The file does not state that it is intended only for a Chinese-speaking audience or provide an opt-in/alternative locale, so this is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The missing-token message is presented only in Chinese, and additional validation errors in the file are also Chinese-only. This creates a language policy concern because the skill forces a specific language for user-visible output without opt-in or localization choice.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/google_search.py (reported line 303)May include surrounding context.

python

params[key] = cleaned

    for field in FIELDS:
        value = clean_value(getattr(args, field))
        if value is not None:
            params[field] = value

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This code emits natural-language messages in Chinese for invalid JSON input, which imposes a specific language on users without any opt-in or alternative locale handling. The same file also prints a Chinese table header later, reinforcing a fixed-language UX rather than a documented locale-specific tool.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The generated confirmation table uses Chinese column headers only, which is a language policy concern when the tool does not offer users a choice of locale. The file contains no indication that this is a region-specific or Chinese-only skill with justified documentation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.