T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/wait_for_task.py:34- Finding
API Credential Exposed in Task-Status and Download Query Strings
- Content
View full analysis
`. 5. A reve ...[truncated 979 chars]- Remediation
View remediation
Security audit
Dataify Lead Intelligence
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly aligned with lead research, but it bundles an unrelated Amazon review scraper and handles the Dataify token in a way that could expose it in URLs.
Review before installing. Use a limited Dataify API token if possible, avoid persistent token setup unless you need it, and be aware that installing this package may expose an unrelated Amazon review-scraping capability in addition to lead intelligence. Rotate the token if you suspect URLs or logs captured it.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
_dependencies/skills/dataify-task-operations/scripts/wait_for_task.py:34- Finding
Duplicated Task Runtime Exposes API Credential in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
` after confirming server support. 4. Centralize task-waiting logic in one maintained implementation to prevent security fixes from diverging across duplicate files. 5. Add regression tests that inspect generated request URLs and fail if credentials appear in them. 6. Redact sensitive query parameters in server, proxy, and monitoring configurations during migration. 7. Rotate tokens potentially retained in historical URL logs and investigate unexpected API or credit usage. ]]>
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (42)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Authenticated API polling, JSON download, and wait/resume functionality are significant runtime behaviors not reflected in the declared prospecting description. This mismatch can hide cost-incurring and data-collection actions behind a benign-seeming interface, increasing the chance of misuse or unauthorized operation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Authenticated API polling, JSON download, and wait/resume functionality are significant runtime behaviors not reflected in the declared prospecting description. This mismatch can hide cost-incurring and data-collection actions behind a benign-seeming interface, increasing the chance of misuse or unauthorized operation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Authenticated API polling, JSON download, and wait/resume functionality are significant runtime behaviors not reflected in the declared prospecting description. This mismatch can hide cost-incurring and data-collection actions behind a benign-seeming interface, increasing the chance of misuse or unauthorized operation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Authenticated API polling, JSON download, and wait/resume functionality are significant runtime behaviors not reflected in the declared prospecting description. This mismatch can hide cost-incurring and data-collection actions behind a benign-seeming interface, increasing the chance of misuse or unauthorized operation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Authenticated API polling, JSON download, and wait/resume functionality are significant runtime behaviors not reflected in the declared prospecting description. This mismatch can hide cost-incurring and data-collection actions behind a benign-seeming interface, increasing the chance of misuse or unauthorized operation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Authenticated API polling, JSON download, and wait/resume functionality are significant runtime behaviors not reflected in the declared prospecting description. This mismatch can hide cost-incurring and data-collection actions behind a benign-seeming interface, increasing the chance of misuse or unauthorized operation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Authenticated API polling, JSON download, and wait/resume functionality are significant runtime behaviors not reflected in the declared prospecting description. This mismatch can hide cost-incurring and data-collection actions behind a benign-seeming interface, increasing the chance of misuse or unauthorized operation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Authenticated API polling, JSON download, and wait/resume functionality are significant runtime behaviors not reflected in the declared prospecting description. This mismatch can hide cost-incurring and data-collection actions behind a benign-seeming interface, increasing the chance of misuse or unauthorized operation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Authenticated API polling, JSON download, and wait/resume functionality are significant runtime behaviors not reflected in the declared prospecting description. This mismatch can hide cost-incurring and data-collection actions behind a benign-seeming interface, increasing the chance of misuse or unauthorized operation.
- Content
YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]
High
- Category
- YARA Match
- Confidence
- 75% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
ershell $env:DATAIFY_API_TOKEN = "YOUR_TOKEN" if ($env:DATAIFY_API_TOKEN) { "configured" } else { "missing" }
text Windows Command Prompt: ```cmd set DATAIFY_API_TOKEN=YOUR_TOKEN if defined DATAIFY_API_TOKEN (echo configured) else (echo missing)Persistent configuration
macOS zsh:
bash echo 'export DATAIFY_API_TOKEN="YOUR_TOKEN"' >> ~/.zshrc source ~/.zshrcLinux bash:
bash echo 'export DATAIFY_API_TOKEN="YOUR_TOKEN"' >> ~/.bashrc source ~/.bashrcWindows PowerShell user environment:
powershell [Environment]::SetEnvironmentVariable("DATAIFY_API_TOKEN", "YOUR_TOKEN", "User")Windows Command Prompt user environment:
cmd setx DATAIFY_API_TOKEN "YOUR_TOKEN"Persistent changes affect new processes. Tell the user to open a new terminal or restart the agent application when the active process cannot see the updated value.
Project
.envRecommend a project
.envonly when the actual command explicitly loads it. Creating the file alone does n
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The embedded skill is for Amazon review scraping, but it is packaged under a lead-intelligence context that is supposed to focus on company discovery and qualification. This capability mismatch can bypass expected scope controls and route users or agents into collecting unrelated third-party data, increasing the risk of policy circumvention, misuse, and unreviewed external data collection behavior.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This agent advertises and defaults to an Amazon comment collection workflow, which is materially unrelated to the parent skill's stated purpose of lead intelligence and company ranking. That mismatch is dangerous because it can enable hidden or unintended data-collection behavior under a trusted package name, increasing the chance of misuse, policy bypass, or supply-chain style confusion for users and orchestrators.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The file defines Amazon-specific endpoints and defaults inside a skill whose declared purpose is lead-intelligence company discovery and ranking. This capability mismatch is dangerous because it introduces undeclared scraping functionality that can be invoked under the trust boundary of a different skill, increasing the risk of policy bypass, misuse, and supply-chain style hidden behavior.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The core function submits a scraping job for an Amazon product comment spider rather than performing company lead-intelligence analysis. In the context of this skill, that is a hidden off-scope capability and can enable unauthorized data collection workflows, misleading users about what the skill does and expanding the attack surface through external task submission.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill declares no explicit tool/permission scope despite describing behavior that relies on environment inspection, shell interaction, file access, and network/API usage. Missing scope declarations weaken least-privilege controls and make it easier for broader capabilities to be exercised than users or reviewers would expect.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## Account CTA policy - Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits. - For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat. - Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks. - After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it. - Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## Account CTA policy - Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits. - For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat. - Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks. - After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it. - Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## Account CTA policy - Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits. - For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat. - Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks. - After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it. - Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## Account CTA policy - Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits. - For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat. - Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks. - After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it. - Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits. - For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat. - Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks. - After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it. - Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control. - For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management. - During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits. - For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat. - Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks. - After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it. - Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control. - For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management. - During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits. - For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat. - Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks. - After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it. - Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control. - For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management. - During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits. - For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat. - Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks. - After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it. - Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control. - For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management. - During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md 2. Read `DATAIFY_API_TOKEN` from the environment. Never accept or print it as a command-line argument. If it is missing, follow [Token setup](references/token-setup.md), show only the current platform's setup command, and resume this workflow after safe verification. 3. Use an installed Dataify task-status/result tool when available. Do not invent an endpoint that is not documented in the repository or exposed by a connected tool. 4. After a scraper submission, monitor by default with `scripts/wait_for_task.py`. Stop at submission only when the user explicitly asks for a task ID or `--no-wait` behavior. 5. If status is queued or running, continue bounded monitoring. Do not ask the user to request monitoring separately. 6. If succeeded, download and return the available result. Summarize large results and preserve access to raw data. 7. If failed, return the provider error, likely corrective action, and whether retrying is safe. 8. If monitoring times out or is interrupted, report the task ID and exact resume command. Never resubmit merely because monitoring stopped.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## Safety - Do not retry paid or high-volume tasks without confirmation. - Do not expose tokens, cookies, signed URLs, or private result contents in logs. - Do not infer success from the presence of a task ID.
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- _dependencies/skills/dataify-task-operations/scripts/task_runtime.py:38
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- scripts/task_runtime.py:38