T01 · Skill Instruction Hijacking
Error
- Location
SKILL.zh-CN.md:3- Finding
Localized Instructions Hijack Skill Activation and Completion Behavior
- Content
View full analysis
- Remediation
View remediation
Security audit
Dataify Google Shopping Keywords
Security checks for vulnerabilities and agentic risk
Overview
This skill mostly fits Google Shopping data collection, but it has review-worthy risks around mismatched localized instructions, token handling, and an unpinned helper-code import.
Install only after reviewing the localized Chinese instructions and the external dataify-task-operations dependency. Prefer using a session-scoped DATAIFY_API_TOKEN or a secret manager, do not pass tokens on the command line, and verify that the helper task_runtime code comes from a trusted, pinned source before running the skill.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.zh-CN.md:16- Finding
Localized Setup Instructions Persist API Tokens in Plaintext Shell Profiles
- Content
View full analysis
> ~/.bashrc source ~/.bashrc ``` ```bash echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.zshrc source ~/.zshrc ``` The same section also instructs the Agent to use a token supplied in the user's request. ### Technical Analysis The localized documentation recommends putting a long-lived API token directly into user-level environment configuration or plaintext shell startup files. Commands containing the literal token may also be retained in shell history, terminal logging, support bundles, or command telemetry. This guidance conflicts with `SKILL.md`, which says never to ask users to paste tokens into chat and recommends matching, session-scoped setup commands first. Persisting a secret is not necessary to submit a Dataify request; a session-scoped environment variable or protected secret store is sufficient. Although environment variables are a common application interface, directly embedding a long-lived token in `.bashrc` or `.zshrc` broadens its exposure to every process launched from the shell and to any user or process that can read those files. ### Attack Path 1. A user follows the localized setup instructions. 2. The user enters a command containing the literal API token. 3. The command is retained in shell history or terminal telemetry. 4. The token is also written in plaintext to a shell startup file or user-level environment configuration. 5. A local process, support tool, backup system, or another user with file access reads the stored secret. 6. The exposed token is used to authenticate to the Datai ...[truncated 552 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
scripts/google_shopping_keywords.py:16- Finding
Unpinned Sibling Module Is Executed and Receives the Bearer Token
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/google_shopping_keywords.py:49- Finding
API Token Can Be Exposed Through Command-Line Arguments
- Content
View full analysis
str: token = clean_value(token) or clean_value( os.environ.get("DATAIFY_API_TOKEN") ) if not token: raise SystemExit(TOKEN_MISSING_MESSAGE) if token.lower().startswith("bearer "): return token return f"Bearer {token}" ``` ### Technical Analysis The script supports passing the API credential through `--token`. Command-line arguments are commonly visible in shell history, process inspection utilities, audit logs, crash diagnostics, job metadata, and execution telemetry. The environment-variable fallback is sufficient for the script's declared functionality. Therefore, exposing an additional command-line secret channel is unnecessary and increases the credential's attack surface. The script does not print the token during ordinary execution, and the direct Builder request sends it only as an authorization header to the declared HTTPS endpoint. The vulnerability is specifically the local argument-handling channel. ### Attack Path 1. A user runs the script with a command such as: ```bash python scripts/google_shopping_keywords.py --keyword iphone --token SECRET ``` 2. The command is stored in shell history or captured by local process monitoring. 3. Another local user, process, telemetry system, or support collector reads the arguments. 4. The attacker extracts the token. 5. The token is used to authenticate to Dataify within the credential's assigned permissions. ### Impact Assessment The exposed token may allow unauthorized use of the associated Dataify account, including paid task submission, credit consumption, and access ...[truncated 225 chars]- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (10)
Tainted flow: 'request' from os.environ.get (line 133, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python }, ) try: with urllib.request.urlopen(request, timeout=timeout) as response: return response.read().decode("utf-8", errors="replace") except urllib.error.HTTPError as exc: body = exc.read().decode("utf-8", errors="replace")
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The manifest explicitly broadens a Google Shopping keyword collection skill to also trigger on Instagram Reel information phrases, which is unrelated to the stated purpose of the skill. This scope expansion can cause the wrong skill to activate for unrelated requests, routing data collection actions into an unintended domain and increasing the chance of unauthorized or misleading scraping behavior.
- Content
YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]
High
- Category
- YARA Match
- Confidence
- 75% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
量，而不是只在当前终端临时设置。
Windows PowerShell，当前用户永久设置：
powershell [Environment]::SetEnvironmentVariable("DATAIFY_API_TOKEN", "your_token_here", "User")然后重新打开 PowerShell。如果当前会话也要立即生效，再执行：
powershell $env:DATAIFY_API_TOKEN = "your_token_here"macOS 或 Linux，bash 永久设置：
bash echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.bashrc source ~/.bashrcmacOS 或 Linux，zsh 永久设置：
bash echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.zshrc source ~/.zshrc核心工作流程
- 从用户请求中识别采集模式。
- 提交前，以 Markdown 表格展示必填参数、可选参数和默认值。
- 规范化并验证最终参数值。
- 获取 Dataify token（用户提供或已保存的
DATAIFY_API_TOKEN）。 - 如果没有 token，提示用户前往 Dataify 获取。
- 提
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill invokes local Python scripts, checks environment variables, and submits network requests, but it does not declare any explicit tool scope or allowed-tools boundaries. That increases the chance an agent will execute code or access env/network capabilities more broadly than intended, weakening least-privilege controls and making misuse or prompt-injection side effects harder to contain.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## Account CTA policy - Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits. - For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat. - Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks. - After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it. - Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## Account CTA policy - Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits. - For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat. - Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks. - After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it. - Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits. - For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat. - Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks. - After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it. - Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control. - For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management. - During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits. - For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat. - Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks. - After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it. - Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control. - For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management. - During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger description contains very broad and ambiguous phrases such as gather/scrape/crawl/fetch/extract/collect product-related data, making activation boundaries unclear. Overbroad trigger logic can cause the skill to run on requests outside the intended scope, increasing the risk of unintended scraping actions, incorrect tool selection, and policy bypass through vague wording.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
L62 says that after successful submission the user should be told to go to Dataify to view or manage results. But L94 says that during successful completion, the skill must not promote registration or the Dashboard. These instructions conflict about what the skill should say on success.
- Content
Static analysis
No suspicious patterns detected.