Dataify Indeed Job Listings

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:15 AM UTC
• Version: 1.3.0

Overview

The skill’s Dataify/Indeed function is coherent, but it needs review because it handles API tokens in risky ways and loads unreviewed sibling code at runtime.

Review before installing. Use this only for explicit Indeed job URLs, avoid passing the token with --token, prefer a session-scoped environment variable or credential manager, and make sure the sibling dataify-task-operations code is trusted before running result monitoring. If you already stored the token in a shell profile from the Chinese instructions, remove it and rotate the token.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T07 · Tool Hijacking and Spoofing

Warning

• Location: scripts/indeed_job_listings.py:16

Finding

Untrusted External Module Loading Enables Local Tool Hijacking

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/indeed_job_listings.py:47

Finding

API Token Can Be Exposed Through Command-Line Arguments

Content

View full analysis

str: token = clean_value(token) or clean_value(os.environ.get("DATAIFY_API_TOKEN")) if not token: raise SystemExit(TOKEN_MISSING_MESSAGE) if token.lower().startswith("bearer "): return token return f"Bearer {token}" ``` ### Technical Analysis The script permits callers to supply the Dataify API token through `--token`. Command-line arguments are commonly retained in shell history and may be visible in process inspection tools, parent-process telemetry, agent execution logs, terminal recording, diagnostic reports, or automation logs. Although transmitting the token in the HTTPS `Authorization` header to the declared Dataify endpoint is necessary for authenticated API access, accepting it through the command line is not necessary. The existing `DATAIFY_API_TOKEN` environment-variable path provides an alternative that avoids placing the credential directly in the invocation text. ### Attack Path 1. A user or automation process runs the script with `--token `. 2. The complete command is saved in shell history, captured by process telemetry, logged by an agent, or temporarily exposed through process inspection. 3. A local user, support operator, monitoring service, or attacker with access to those records retrieves the token. 4. The exposed token is reused against Dataify until it expires or is revoked. 5. The attacker can perform operations allowed by the associated ...[truncated 493 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.zh-CN.md:25

Finding

Localized Documentation Recommends Persistent Plaintext Credential Storage

Content

View full analysis

> ~/.bashrc source ~/.bashrc ``` ```bash echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.zshrc source ~/.zshrc ``` ### Technical Analysis The localized documentation explicitly recommends permanent environment-variable storage and instructs users to append the Dataify token in plaintext to `.bashrc` or `.zshrc`. Shell profiles are not credential stores and may be readable by local tools, copied into backups, included in support bundles, synchronized between systems, or accidentally committed or shared. The persistent setup guidance also conflicts with the safer account policy later in the same file and in `SKILL.md`, which says to show the matching session-scoped setup command first and only discuss persistent setup when ambiguity exists or the user requests it. This behavior does not establish malicious system persistence or a backdoor. The issue is insecure long-term storage of a sensitive API credential. ### Attack Path 1. A user follows the localized documentation. 2. The API token is written in plaintext to `.bashrc`, `.zshrc`, or persistent user environment configuration. 3. The credential remains available across sessions and may be inherited by unrelated child processes. 4. A local process, backup reader, support-data recipient, profile repository, or attacker with access to the user's configuration obtains the token. 5. The token is reused to access Dataify operations and consume account resources. ### Impact Assessment The exposed credential can grant access to the Dataif ...[truncated 467 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Tainted flow: 'request' from os.environ.get (line 133, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/indeed_job_listings.py (reported line 144)May include surrounding context.

python

},
    )
    try:
        with urllib.request.urlopen(request, timeout=timeout) as response:
            return response.read().decode("utf-8", errors="replace")
    except urllib.error.HTTPError as exc:
        body = exc.read().decode("utf-8", errors="replace")

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 44)May include surrounding context.

量，而不是只在当前终端临时设置。

Windows PowerShell，当前用户永久设置：

powershell

[Environment]::SetEnvironmentVariable("DATAIFY_API_TOKEN", "your_token_here", "User")

然后重新打开 PowerShell。如果当前会话也要立即生效，再执行：

powershell

$env:DATAIFY_API_TOKEN = "your_token_here"

macOS 或 Linux，bash 永久设置：

bash

echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.bashrc
source ~/.bashrc

macOS 或 Linux，zsh 永久设置：

bash

echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.zshrc
source ~/.zshrc

核心工作流程

1. 从用户请求中识别采集模式。
2. 提交前，以 Markdown 表格展示必填参数、可选参数和默认值。
3. 规范化并验证最终参数值。
4. 获取 Dataify token（用户提供或已保存的 DATAIFY_API_TOKEN）。
5. 如果没有 token，提示用户前往 Dataify 获取。
6. 提

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill instructs the agent to use local Python, inspect environment setup, and submit network requests, but it does not declare any explicit tool scope or permission boundaries. This increases the risk of over-broad agent execution because the runtime may allow environment and network access without a least-privilege declaration, making misuse or unintended data exposure more likely.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger language is broad enough to match generic requests for job listings, postings, or job information, even though the skill is supposed to be limited to known Indeed job URLs. That can cause the skill to activate outside its intended scope, leading the agent to make external requests or guide the user into a workflow that is inappropriate for the original request.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md

## Account CTA policy

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 90)May include surrounding context.

md

## Account CTA policy

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

md

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
- For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management.
- During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger description is overly broad and includes many generic scrape/fetch/extract phrases, increasing the chance that the skill activates in unintended contexts. In this skill, accidental activation matters because the workflow can lead to external task creation and token-handling flows, expanding the blast radius of a false trigger.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill’s documented workflow goes beyond extracting data from a provided Indeed URL and instructs the agent to create a remote Dataify scraping task. That expands the capability boundary from local parameter handling into external task submission, which can trigger unintended third-party actions and data processing if the skill is mis-invoked or over-broadly triggered.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The core workflow explicitly says that after successful submission the skill should tell the user to go to Dataify to view or manage results. Later, the Account CTA policy says that during normal submission, processing, and successful completion, the skill should not promote registration or the Dashboard. These instructions conflict directly about post-success behavior.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

The instruction to continue the original task automatically after detecting a configured token reduces user awareness around when an external action may be taken. In a skill that can submit remote scraping jobs, autonomous continuation can cause unintended third-party requests or credit consumption without a fresh, contextual confirmation.

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 92)May include surrounding context.

md

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
- For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management.
- During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The OpenAI-facing UI text says the skill can 'Collect Indeed Job Listings data and return results' without preserving the stricter manifest constraint that it should only be used for a known Indeed job URL and not for broad discovery or company profiles. This mismatch can cause an agent to invoke the skill in broader contexts than intended, potentially leading to overcollection, policy bypass, or misuse of the underlying connector outside its safe operating scope.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The stated purpose is narrowly about collecting job-posting data from an Indeed URL, but the file adds account-token acquisition, environment-variable lookup, and token verification flows. While token use may support the backend service, the persistent credential-management guidance is a capability not justified by the narrow user-facing purpose alone.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.