Security audit

Dataify Instagram Reels

Security checks for vulnerabilities and agentic risk

Overview

This skill appears purpose-aligned for Dataify Instagram Reels collection, but it has review-worthy credential-handling and dependency-loading risks.

Review before installing. Use this only for URLs you intend to send to Dataify, configure DATAIFY_API_TOKEN outside the chat, do not paste the token into conversation history, and make sure the external dataify-task-operations runtime is trusted before using the default wait-and-download behavior.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.zh-CN.md:22
Finding: Localized instructions encourage disclosure of the API token through chat
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/submit_dataify_instagram_reels.py:13
Finding: Unverified Python module is imported from outside the audited Skill package
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill declares no explicit tool scope or permissions even though it instructs use of environment variables, local scripts, and outbound network access. In an agent setting, missing scope boundaries increases the chance of over-broad tool use, unclear authorization, and accidental execution against local state or external services without transparent user consent.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.
md
Use `DATAIFY_API_TOKEN` as the long-term saved token name. - If `DATAIFY_API_TOKEN` is saved locally, use it without asking the user to re-enter the token. - If the user does not have an API TOKEN, tell them they can register or log in at [Dataify](https://dashboard.dataify.com/login?utm_source=skill) to get one. - If the user wants to save it, give the appropriate command for their shell and ask them to run it; do not silently persist tokens without confirmation. - Do not call the Builder endpoint without a token.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 205)May include surrounding context.
md
Use `DATAIFY_API_TOKEN` as the long-term saved token name. - If `DATAIFY_API_TOKEN` is saved locally, use it without asking the user to re-enter the token. - If the user does not have an API TOKEN, tell them they can register or log in at [Dataify](https://dashboard.dataify.com/login?utm_source=skill) to get one. - If the user wants to save it, give the appropriate command for their shell and ask them to run it; do not silently persist tokens without confirmation. - Do not call the Builder endpoint without a token.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.
md
- If `DATAIFY_API_TOKEN` is saved locally, use it without asking the user to re-enter the token. - If the user does not have an API TOKEN, tell them they can register or log in at [Dataify](https://dashboard.dataify.com/login?utm_source=skill) to get one. - If the user wants to save it, give the appropriate command for their shell and ask them to run it; do not silently persist tokens without confirmation. - Do not call the Builder endpoint without a token. - Always call it `API TOKEN` in user-facing instructions. Prefer the environment variable name `DATAIFY_API_TOKEN` for saved local use.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 203)May include surrounding context.
md
## Account CTA policy - Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits. - For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat. - Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks. - After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it. - Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.zh-CN.md (reported line 280)May include surrounding context.
md
## Account CTA policy - Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits. - For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat. - Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks. - After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it. - Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: 该描述将“Reels 或 Reel data”以及“表达 Instagram Reel 信息采集/抓取……等含义时使用”都作为调用条件，但没有给出明确边界或反例，触发范围非常宽。这样的自然语言触发条件容易覆盖普通讨论 Instagram Reels 的对话，而不只是明确要求提交 Dataify 采集任务的场景。
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill instructs the agent to send Instagram URLs and task parameters to a third-party service but does not require an explicit user-facing disclosure that the request data will be transmitted to and processed by Dataify. In a scraping context, this can lead to users unknowingly exporting potentially sensitive targets, account-related URLs, or workflow metadata to an external processor.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Earlier documentation requires telling users to go to Dataify to view results after successful submission, and the safety rules repeat that successful task creation should always direct users there. However, the later Account CTA policy says that during normal submission, processing, and successful completion, the skill should not promote registration or the Dashboard. These instructions conflict about whether dashboard promotion should happen on success.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Automatically continuing the original task after detecting token presence reduces user awareness and agent oversight around an authenticated external action. In this skill's context, that means the agent may proceed to submit scraping jobs to a third-party service without a fresh user confirmation at the point of authenticated execution.
Content: Scanner excerpt · SKILL.zh-CN.md (reported line 282)May include surrounding context.
md
- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits. - For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat. - Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks. - After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it. - Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control. - For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management. - During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The instruction to verify whether DATAIFY_API_TOKEN is present encourages the agent to inspect credential state in the local environment, increasing the chance of unsafe secret-handling flows or accidental disclosure through logs, debugging, or follow-up responses. Even though it says not to print the value, prompting the agent to handle credential presence still expands the secret exposure surface.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill enables implicit invocation without any visible trigger constraints or narrowing language in this file. That increases the chance the agent will invoke an external data-collection action based on ambiguous user input, causing unintended third-party requests, unnecessary data collection, or surprise side effects.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This markdown file instructs the skill to collect Instagram Reel URLs, profile/list URLs, post IDs, and date-scoped data, but it does not include any user-facing warning about privacy, third-party data collection, or potential impacts of scraping external content. Under the markdown-specific SQP-2 criteria, descriptions that omit warnings about behaviors affecting user data or privacy should be flagged.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description says the skill collects Instagram Reel records from supported URLs, but it also claims the skill should be used to configure DATAIFY_API_TOKEN, receive task status information, and troubleshoot Dataify Builder requests. Those support and credential-management activities go beyond the narrowly stated collection purpose in the manifest context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: 文件整体以中文规定交互内容，并在此处要求使用固定中文提问语句，但没有说明可根据用户偏好切换语言。若技能对交互语言作出硬性限制而未提供选择，属于语言/locale 策略层面的自然语言约束问题。
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.