Dataify Google Shopping

• Outcome: Review
• Latest audit: Jul 16, 2026 · 8:46 PM UTC
• Version: 1.2.0

Overview

This is a disclosed Dataify Google Shopping helper that requires user confirmation before sending shopping search parameters to Dataify.

Install only if you are comfortable sending confirmed shopping queries, filters, and your Dataify API token to Dataify. Keep the token scoped to this service, avoid pasting it into unrelated chats, and review the confirmation table before approving each call.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill instructs the agent to read environment state for `DATAIFY_API_TOKEN`, access local bundled files/scripts, and make outbound network requests, but no declared permissions are present. This creates a capability/authorization mismatch where a reviewer or runtime may not have clear visibility that the skill can exfiltrate user queries and token-backed requests to an external service.

Context-Inappropriate Capability

Medium

• Confidence: 82% confidence
• Finding: The skill reads an API credential from the environment and then writes the normalized Bearer token back into the process environment. For a narrow shopping-search skill, persisting secrets in environment state is broader than necessary and can increase exposure to other code in the same process, logs, crash dumps, or downstream subprocesses if any are added later.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger phrases are broad enough that ordinary requests like shopping search, product search, or price comparison may activate the skill in contexts where the user did not specifically intend to call an external scraper-backed tool. Over-broad activation increases the chance of unintended data transfer to a third-party API and can bypass user expectations about when tools are invoked.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger description is broad enough to match common shopping-related phrases such as 'price comparison' or generic product search requests, which can cause the skill to activate when the user did not specifically intend to call this external-shopping integration. In this skill, that matters because activation can lead to collection of detailed query parameters and eventual transmission of user-provided shopping intent to a third-party API, increasing privacy and consent risk through misrouting.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The default prompt uses a broad invocation phrase, 'Use $dataify-google-shopping to run a search query,' which can cause the skill to trigger on loosely related requests rather than clear, user-intended shopping actions. This increases the chance of unintended tool use, misrouting user requests, and unnecessary disclosure of user queries to an external shopping/search integration.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

return None
    if not token.lower().startswith("bearer "):
        token = f"Bearer {token}"
    os.environ["DATAIFY_API_TOKEN"] = token
    return token

• Confidence: 90% confidence
• Finding: Writing the API token into os.environ persists a sensitive credential in mutable process-global state. Even though the script does not exfiltrate it directly, this increases the blast radius of the secret by making it accessible to any other in-process component and potentially to child processes or diagnostics.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical

• Code: suspicious.secret_argv_exposure
• Location: SKILL.md:72

Instructions pass high-value credentials through process argv.

Critical

• Code: suspicious.secret_argv_exposure
• Location: SKILL.zh-CN.md:73