Dataify Google Trends

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:22 AM UTC
• Version: 1.3.0

Overview

This skill is a disclosed Google Trends-to-Dataify API helper; it uses a Dataify token and sends trend queries externally, but I did not find hidden, destructive, persistent, or unrelated behavior.

Install only if you are comfortable using Dataify for Google Trends requests. Configure DATAIFY_API_TOKEN through your environment, do not paste it into chat, and avoid sending sensitive search terms because the query parameters are submitted to Dataify's external API.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose is a simple Google Trends search skill, but the behavior described includes local file parsing, request preview generation, and script-driven processing that is broader than the advertised function. This mismatch can mislead operators and downstream policy engines about what the skill actually does, weakening trust boundaries and increasing the chance that extra capabilities are granted without proper review.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill declares no explicit tool scope even though its instructions rely on environment access, local file reads, and network/API interaction. In an agent setting, missing scope boundaries can lead to over-broad execution privileges, making it easier for the skill to access sensitive environment variables or perform unintended network/file operations if reused or misinterpreted by the runtime.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

L031 instructs the skill to return the final script output directly and not summarize, extract, clean, translate, or reshape the API response. Later, L074-L076 directs the skill to return a compact user-facing result by default, hide parts of the response envelope, and only return raw JSON/HTML on explicit request, which is an active contradiction in documented intent.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 76% confidence

Finding

The skill instructs the agent to verify whether DATAIFY_API_TOKEN is present and continue the original task automatically. Even though it says not to print the value, this still normalizes environment inspection and autonomous continuation around credential state, which can be risky in shared or loosely scoped runtimes because it encourages secret-adjacent checks without an explicit permission boundary.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
- For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management.
- During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

L32 instructs the agent to return the final script output directly and not summarize, extract, clean, translate, or reformat the API response. But L75-L77 later says the default is to return condensed results and only return raw JSON/HTML when explicitly requested. These directions are materially inconsistent about the skill's intended behavior.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

md

## Account CTA policy

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 92)May include surrounding context.

md

## Account CTA policy

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 94)May include surrounding context.

md

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
- For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management.
- During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The default prompt 'Use $dataify-google-trends to run a search query.' is broad and does not clearly constrain usage to Google Trends trend/interest queries only. This can cause the agent to invoke the skill for generic search-related requests, increasing the chance of unintended tool use, policy bypass through ambiguous routing, or disclosure of irrelevant external data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The script builds a POST request from parsed parameters, including the required query field derived from user input, and sends it to Dataify's external API. Although the module docstring says it calls the API, there is no runtime confirmation or explicit privacy warning before transmitting user-provided request content off-box.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script prints a parameter preview table to stdout using all current request parameters, including arbitrary values supplied via --params-json or unknown --key value arguments. Because there is no filtering or masking for sensitive keys, secrets such as tokens, cookies, or API credentials could be exposed in terminal history, logs, CI output, or agent transcripts if a caller accidentally includes them.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The markdown includes an example request parameter object with hl":"en", which prescribes English as the interface language. While examples are allowed, this can encourage defaulting to English without explicit user choice, and there is no accompanying justification that the skill is English-only or region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The example command hard-codes "hl":"en", which implies English output as the default locale. Because this file does not state that English is optional or justified by a region-specific requirement at that point, it can conflict with a language/locale policy requiring user choice.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The top-level docstring says the script simply calls the Dataify Google Trends API and prints the raw response body, and the argparse description repeats that framing. In reality, the script also performs substantial request interpretation and alternate output modes that do not call the API or print a raw response body.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code contains a user-facing token error message entirely in Chinese. The stated policy flags language or locale constraints when a skill forces a specific language without user opt-in, and there is no visible alternative-language path or opt-in here.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The CLI description presents the tool as a straightforward API caller, but the code supports local parsing of requests, preview-table rendering, dry-run JSON emission, and conditional non-network execution paths. This is an active mismatch between the documented intent and the actual behavior exposed by the command-line interface.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/google_trends.py (reported line 485)May include surrounding context.

python

params[key] = cleaned

    for field in FIELDS:
        value = clean_value(getattr(args, field))
        if value is not None:
            params[field] = value

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest scopes the skill to searching Google Trends data, but this function additionally retrieves credentials from the process environment and writes the normalized bearer token back into an environment variable. Credential handling may be a practical implementation detail, but persisting it in environment state is not justified by the user-facing purpose described in the manifest.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script emits error messages only in Chinese for invalid JSON input, which imposes a specific language on all users without opt-in or documented locale scope. This matches the language/locale policy concern because the file does not offer a language choice or justify a region-specific constraint.

Content

No source excerpt is available for this finding.