Dataify Instagram Comment By Post URL

• Outcome: Pass
• Latest audit: Jul 16, 2026 · 8:44 PM UTC
• Version: 1.2.0

Overview

This skill is a disclosed Dataify task submitter for Instagram comment collection, with expected token use and external API submission.

Install this only if you intend to submit Instagram post-comment collection jobs through Dataify. Review the post URLs before submission, understand that task parameters are sent to Dataify under your account, and be careful with any saved DATAIFY_API_TOKEN because the skill can reuse it for future submissions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill explicitly instructs the agent to read a locally saved environment token and make outbound network requests, but no declared permissions are present to signal those capabilities. This creates a transparency and governance gap: users or hosting platforms may not realize the skill can access secrets and contact an external service, increasing the risk of unintended token use or policy bypass.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger description is unusually broad and includes many generic scraping/collection phrases, which can cause the skill to activate when a user did not explicitly intend to use this third-party data collection workflow. In context, that increases the chance of unintended submission of Instagram URLs and related task parameters to Dataify, creating consent, privacy, and workflow-integrity risks rather than direct code-execution risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs the agent to submit Instagram post-comment collection jobs to a third-party service but does not clearly warn users that URLs, collected comment data, and associated task metadata will be transmitted to Dataify. In this context, the omission is security-relevant because users may unknowingly initiate external data processing that has privacy, compliance, or terms-of-service implications.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The skill enables implicit invocation while exposing a broad default prompt and metadata that can match loosely phrased user requests about Instagram comment collection, task status, token configuration, or troubleshooting. This creates a real risk that the agent will invoke the skill without sufficiently explicit user intent, potentially causing unintended third-party API actions, data collection requests, or handling of sensitive configuration flows.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- If the user provides a token in the request, use it for this run.
- If no token is provided, first check whether `DATAIFY_API_TOKEN` is already saved locally in the environment.
- If `DATAIFY_API_TOKEN` is saved locally, use it without asking the user to re-enter the token.
- If no token is available locally, tell the user they need to provide a Dataify API TOKEN.
- If the user does not have an API TOKEN, tell them they can register or log in at [Dataify](https://dashboard.dataify.com/login?utm_source=skill) to get one.
- If the user already has an API TOKEN, tell them it is available in the top-right area of [Dataify](https://dashboard.dataify.com?utm_source=skill).

• Confidence: 84% confidence
• Finding: without asking

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.