Security audit

Dataify Google Shopping Keywords

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a disclosed Dataify Google Shopping task creator, but its trigger text also covers unrelated Instagram Reel requests and its credential-storage guidance is under-scoped.

Review this skill before installing. It should be limited to Google Shopping keyword collection, and users should avoid invoking it for Instagram Reel scraping. Treat DATAIFY_API_TOKEN as a secret; prefer a secret manager or temporary environment variable, and do not store it in shared or synced shell startup files unless you understand the exposure risk.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The skill claims to collect Google Shopping product information, but the documented behavior is to create remote scraping tasks and return task metadata rather than directly retrieving results. Its trigger text also includes unrelated Instagram Reel phrases, creating a mismatch that can cause unintended invocation and user confusion about what data is actually being accessed or what external action will be taken.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: Including Instagram Reel scraping triggers in a Google Shopping skill can route unrelated user requests into the wrong automation path. In a security context, overly broad or misleading invocation text increases the chance of unauthorized or unintended external scraping actions being initiated under false assumptions.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The manifest description includes Instagram Reel scraping trigger phrases even though the skill only documents and supports Google Shopping keyword collection. This mismatch can cause the skill to be invoked for unrelated user requests, leading to unintended data collection behavior and incorrect tool selection.

Vague Triggers

High

Confidence: 95% confidence
Finding: An overly broad trigger description can cause the skill to activate for unrelated scraping requests, increasing the chance of unintended network calls, token usage, and task creation on a third-party service. Because this skill can submit external jobs using an API token, accidental invocation has stronger consequences than a purely local or read-only skill.

Vague Triggers

High

Confidence: 96% confidence
Finding: Including Instagram Reel-related trigger phrases in a Google Shopping skill creates a cross-domain scope mismatch that makes activation boundaries unclear. This can cause the skill to handle requests outside its intended purpose, increasing the risk of data misuse, policy bypass, or execution of the wrong external workflow.

Vague Triggers

High

Confidence: 96% confidence
Finding: Including Instagram Reel-related trigger phrases in a Google Shopping skill creates a cross-domain scope mismatch that makes activation boundaries unclear. This can cause the skill to handle requests outside its intended purpose, increasing the risk of data misuse, policy bypass, or execution of the wrong external workflow.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill instructs users to provide and persist an API token, including storing it in long-lived environment variables, but does not clearly warn about credential sensitivity, shell history exposure, shared-machine risks, or least-privilege handling. This can lead to token leakage or unsafe storage practices by users following the instructions.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical

Code: suspicious.secret_argv_exposure
Location: SKILL.md:50