Dataify Indeed Companies Info

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:06 AM UTC
• Version: 1.3.0

Overview

This skill appears purpose-built for Dataify Indeed company collection, but it has review-worthy credential-handling and unreviewed local code-loading risks.

Install only if you are comfortable with Dataify receiving the collection parameters and using your Dataify API token. Prefer a session-scoped environment variable or a proper secret manager, do not paste tokens into chat or command lines, and avoid the Chinese persistent shell-profile setup commands. Treat the external dataify-task-operations dependency as part of the trusted computing base before running the result-waiting workflow.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: scripts/indeed_companies_info.py:13

Finding

Untrusted sibling-module loading permits arbitrary code execution

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.zh-CN.md:31

Finding

Documentation directs users to persist API tokens in plaintext shell startup files

Content

View full analysis

> ~/.bashrc source ~/.bashrc ``` ```bash echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.zshrc source ~/.zshrc ``` ### Technical Analysis The localized instructions recommend saving the Dataify bearer token persistently. On macOS and Linux, the documented commands write the literal token into `.bashrc` or `.zshrc`. These are plaintext files that are routinely read by every interactive shell and may be copied into backups, diagnostic archives, or dotfile repositories. The commands may also place the literal token in shell history. Once loaded from a startup file, the environment variable is inherited by unrelated child processes launched from that shell, broadening the number of processes capable of reading the credential. The guidance conflicts with the safer account policy later in the same file and in `SKILL.md`, which calls for session-scoped setup first and warns against exposing credentials. ### Attack Path 1. A user follows the localized setup instructions and substitutes a real API token. 2. The literal token is stored in a shell profile and potentially in shell history. 3. An unrelated local process, backup tool, support bundle, dotfile synchronization service, or accidental repository commit captures the file or history. 4. An attacker retrieves the bearer token from the captured plaintext. 5. The attacker submits tasks or otherwise accesses the Dataify account within the token's permissions. ### Impact Assessment Exposure gives an attacker the privileges associated with the Dataify API token. Potential consequences include: - Unauthorized API requests. - Consumption of account credits. - Cr ...[truncated 347 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/indeed_companies_info.py:78

Finding

API token accepted through a command-line argument

Content

View full analysis

str: token = clean_value(token) or clean_value(os.environ.get("DATAIFY_API_TOKEN")) if not token: raise SystemExit(TOKEN_MISSING_MESSAGE) if token.lower().startswith("bearer "): return token return f"Bearer {token}" ``` ### Technical Analysis The script explicitly accepts a bearer token through `--token`. Command-line arguments can be exposed through shell history, process inspection facilities, job-runner metadata, terminal transcripts, debugging logs, and Agent tool-call records. Although the script also supports `DATAIFY_API_TOKEN`, the command-line option provides an avoidable, less secure credential channel. Anyone with access to process metadata or retained command history may recover the token while or after the command runs. ### Attack Path 1. A user or Agent invokes the script with `--token `. 2. The full command is recorded in shell history, an execution log, or an Agent transcript, or is briefly visible through process inspection. 3. Another local user, service, or log reader retrieves the token. 4. The token is reused to authenticate to Dataify. ### Impact Assessment An exposed token grants the attacker the API permissions associated with the affected Dataify account. This can permit unauthorized task submission, credit consumption, and access to task information or results, subject to server-side authorization. Exploitation does not directly elevate operating-system privileges, but it compromises the confidentiality and authority of the external-service credential. ]]>

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (12)

Tainted flow: 'request' from os.environ.get (line 183, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/indeed_companies_info.py (reported line 194)May include surrounding context.

python

},
    )
    try:
        with urllib.request.urlopen(request, timeout=timeout) as response:
            return response.read().decode("utf-8", errors="replace")
    except urllib.error.HTTPError as exc:
        body = exc.read().decode("utf-8", errors="replace")

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 46)May include surrounding context.

量，而不是只在当前终端临时设置。

Windows PowerShell，当前用户永久设置：

powershell

[Environment]::SetEnvironmentVariable("DATAIFY_API_TOKEN", "your_token_here", "User")

然后重新打开 PowerShell。如果当前会话也要立即生效，再执行：

powershell

$env:DATAIFY_API_TOKEN = "your_token_here"

macOS 或 Linux，bash 永久设置：

bash

echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.bashrc
source ~/.bashrc

macOS 或 Linux，zsh 永久设置：

bash

echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.zshrc
source ~/.zshrc

核心工作流程

1. 从用户请求中识别采集模式。
2. 提交前，以 Markdown 表格展示必填参数、可选参数和默认值。
3. 规范化并验证最终参数值。
4. 获取 Dataify token（用户提供或已保存的 DATAIFY_API_TOKEN）。
5. 如果没有 token，提示用户前往 Dataify 获取。
6. 提

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill can access environment variables and the network, but it does not declare any explicit tool scope or permissions boundary. This weakens least-privilege controls and makes it easier for the skill to read sensitive local configuration such as API tokens and immediately send data to an external service, especially because the workflow explicitly depends on env inspection and outbound requests.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

md

## Account CTA policy

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 92)May include surrounding context.

md

## Account CTA policy

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

md

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
- For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management.
- During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 94)May include surrounding context.

md

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
- For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management.
- During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger description uses broad verbs like gather, scrape, crawl, fetch, extract, and collect tied to Indeed company information. Overly broad routing can cause this skill to activate for loosely related requests, leading to unintended third-party scraping actions or data transmission beyond what the user specifically intended.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill instructs the agent to retrieve a stored API token and submit tasks to an external Dataify service without a clear user-facing disclosure that credentials and request parameters will be used with a third party. This creates a transparency and consent problem and can cause users to unknowingly send data to an external service.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill gives conflicting guidance on credential handling: it allows use of a token supplied in the request, while later saying the user should never be asked to paste the token into chat. That inconsistency can lead agents to solicit or accept secrets through the chat channel, increasing the chance of credential exposure in logs, transcripts, or downstream tools.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/indeed_companies_info.py (reported line 140)May include surrounding context.

python

if provided_sets is None:
        values = dict(spider["defaults"])
        for field in spider["defaults"]:
            value = clean_value(getattr(args, field, None))
            if value is not None:
                values[field] = value
        provided_sets = [values]

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/preview_params.py (reported line 120)May include surrounding context.

python

def current_values_from_args(args: argparse.Namespace, fields: list[tuple[str, str, bool, str]]) -> dict[str, Any]:
    values: dict[str, Any] = {}
    for name, _description, _required, _default in fields:
        value = getattr(args, name, None)
        if value is not None:
            values[name] = value
    return values

Static analysis

No suspicious patterns detected.