Security audit

Dataify Linkedin Builder

Security checks for vulnerabilities and agentic risk

Overview

The skill is presented as a LinkedIn company-URL lookup tool, but its instructions and catalog allow broader Dataify scraping requests with weak validation and persistent token guidance.

Review this before installing. Use it only with a Dataify token you are willing to expose to this workflow, prefer session-scoped token setup over shell-profile storage, and avoid running it unless the package is narrowed to the single LinkedIn company URL tool with real URL and parameter validation.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/wait_for_task.py:35
Finding: API Token Transmitted in URL Query Strings
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/catalog_builder.py:53
Finding: Empty Parameter Schemas Allow Unvalidated Builder Payloads
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: SKILL.md:45
Finding: Documentation Encourages Plaintext Persistent API Token Storage
Content: View full analysis
> ~/.bashrc source ~/.bashrc ``` macOS or Linux, permanent for zsh: ```bash echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.zshrc source ~/.zshrc ``` ``` ### Technical Analysis The instructions explicitly prefer persistent environment-variable configuration and recommend writing the API token into shell startup files. Files such as `~/.bashrc` and `~/.zshrc` are plaintext configuration files rather than secret stores. These files may be exposed through: - Local processes running under the same user - Backups and endpoint-management systems - Support bundles or configuration archives - Accidental dotfile synchronization or repository commits - Screen sharing and terminal-history workflows The recommendation also conflicts with the later Account CTA policy, which says session-scoped setup should be shown first and persistent setup only when requested or necessary. ### Attack Path 1. A user follows the documented setup instructions. 2. The Dataify token is written in plaintext to a shell startup file or persistent user environment. 3. A local process, backup reader, support operator, or recipient of accidentally shared dotfiles reads the credential. 4 ...[truncated 643 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (36)

Description-Behavior Mismatch

Critical

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The lead workflow explicitly searches for and accepts Crunchbase organization URLs even though the skill description says not to use Crunchbase URLs. This is a direct contradiction of the declared boundary and enables collection from prohibited sources, making the skill more dangerous because the hidden behavior defeats user expectations and review assumptions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The skill can monitor arbitrary Dataify tasks by task ID and download final JSON results without enforcing that those tasks correspond to LinkedIn company collection. In context, this broadens the skill into a generic result-retrieval interface for external jobs, which can expose unrelated data flows under a misleadingly narrow label.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill can monitor arbitrary Dataify tasks by task ID and download final JSON results without enforcing that those tasks correspond to LinkedIn company collection. In context, this broadens the skill into a generic result-retrieval interface for external jobs, which can expose unrelated data flows under a misleadingly narrow label.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The skill can monitor arbitrary Dataify tasks by task ID and download final JSON results without enforcing that those tasks correspond to LinkedIn company collection. In context, this broadens the skill into a generic result-retrieval interface for external jobs, which can expose unrelated data flows under a misleadingly narrow label.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill can monitor arbitrary Dataify tasks by task ID and download final JSON results without enforcing that those tasks correspond to LinkedIn company collection. In context, this broadens the skill into a generic result-retrieval interface for external jobs, which can expose unrelated data flows under a misleadingly narrow label.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill can monitor arbitrary Dataify tasks by task ID and download final JSON results without enforcing that those tasks correspond to LinkedIn company collection. In context, this broadens the skill into a generic result-retrieval interface for external jobs, which can expose unrelated data flows under a misleadingly narrow label.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill can monitor arbitrary Dataify tasks by task ID and download final JSON results without enforcing that those tasks correspond to LinkedIn company collection. In context, this broadens the skill into a generic result-retrieval interface for external jobs, which can expose unrelated data flows under a misleadingly narrow label.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill can monitor arbitrary Dataify tasks by task ID and download final JSON results without enforcing that those tasks correspond to LinkedIn company collection. In context, this broadens the skill into a generic result-retrieval interface for external jobs, which can expose unrelated data flows under a misleadingly narrow label.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The workflow instructs the user to choose among unrelated job-listing and keyword tools, directly contradicting the skill's stated company-by-URL-only purpose. This is a concrete prompt-level scope expansion that could be used to collect different data types and targets than the user or platform expects.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill is named and described as collecting LinkedIn company information by company URL, but the workflow broadens scope to job-listing URLs, job URLs, and keyword scraping. This scope expansion can cause the agent to perform data collection outside the user's expected task boundaries, increasing the chance of overcollection, policy bypass, or unintended scraping of different resource types.
Content: No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.
量，而不是只在当前终端临时设置。

Windows PowerShell，当前用户永久设置：

powershell
[Environment]::SetEnvironmentVariable("DATAIFY_API_TOKEN", "your_token_here", "User")

然后重新打开 PowerShell。如果当前会话也要立即生效，再执行：

powershell
$env:DATAIFY_API_TOKEN = "your_token_here"

macOS 或 Linux，bash 永久设置：

bash
echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.bashrc source ~/.bashrc

macOS 或 Linux，zsh 永久设置：

bash
echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.zshrc source ~/.zshrc

脚本用法

Python：

bash
python scripts/build-dataify-request.py --tool-sign <selected_tool_sign> --values-file values.json

PowerShell：

powershell
& ".\scripts\build-dataify-request.ps1" -ToolSign "<selected_tool_sign>" -ValuesFile ".\values.json"

values.json 可以是单个对象，也可以是对象数组。

输出格式

最终 curl 命令应为

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · SKILL.zh-CN.md (reported line 49)May include surrounding context.
量，而不是只在当前终端临时设置。

Windows PowerShell，当前用户永久设置：

powershell
[Environment]::SetEnvironmentVariable("DATAIFY_API_TOKEN", "your_token_here", "User")

然后重新打开 PowerShell。如果当前会话也要立即生效，再执行：

powershell
$env:DATAIFY_API_TOKEN = "your_token_here"

macOS 或 Linux，bash 永久设置：

bash
echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.bashrc source ~/.bashrc

macOS 或 Linux，zsh 永久设置：

bash
echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.zshrc source ~/.zshrc

脚本用法

Python：

bash
python scripts/build-dataify-request.py --tool-sign <selected_tool_sign> --values-file values.json

PowerShell：

powershell
& ".\scripts\build-dataify-request.ps1" -ToolSign "<selected_tool_sign>" -ValuesFile ".\values.json"

values.json 可以是单个对象，也可以是对象数组。

输出格式

最终 curl 命令应为

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill is described as collecting LinkedIn company information from known company URLs only, but the tool metadata exposes additional job-listing, job-detail, and keyword-based job scraping capabilities. This creates a scope mismatch that can enable unauthorized or unexpected data collection paths beyond the declared purpose, increasing the risk of misuse and policy evasion.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Job-search and job-detail collection are not justified by a skill intended solely for company information lookup by URL, so their presence represents excess capability. Excess capabilities are dangerous because they broaden what an agent can retrieve, potentially enabling scraping of unrelated datasets and violating least-privilege expectations for both users and platform reviewers.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file is a shared multi-purpose workflow framework supporting price intelligence, review intelligence, lead intelligence, and brand monitoring, which materially exceeds the declared scope of a skill that should only collect LinkedIn company information from known URLs. This scope expansion increases the chance of unauthorized collection, policy bypass, and misuse of the skill for unrelated scraping tasks.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The presence of specialized support for Amazon comment scraping and Google Maps review scraping is unjustified in a skill meant for LinkedIn company information collection. These code paths indicate latent off-purpose scraping capability, increasing the likelihood of unauthorized data collection and deceptive scope presentation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The workflow contains logic for review, pricing, and brand-monitoring searches that are unrelated to collecting LinkedIn company information by URL. Embedding these unrelated capabilities creates hidden functionality that can be repurposed for broader surveillance or scraping than users and reviewers would expect.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The code discovers and schedules additional detail URLs from search results instead of limiting processing to user-provided known company URLs. This allows the workflow to broaden data collection autonomously, which violates the advertised operating model and can pull in unintended domains or entities.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares no explicit tool/permission scope while instructing use of environment inspection, file reads, shell commands, and network access. In an agent environment, missing scope boundaries makes it easier for the skill to invoke more capability than its narrow LinkedIn-company purpose implies, increasing the blast radius of misuse or prompt-instruction abuse.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The workflow instructs the agent to ask the user to choose from a Chinese list of tools, which imposes a specific language on the interaction. There is no user choice, opt-in, or justification for requiring Chinese labels in this step.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 95% confidence
Finding: The skill is explicitly designed to transmit collected parameters and results to an external service at scraperapi.dataify.com. External transmission is expected for this integration, but it remains security-relevant because any user-supplied URLs and derived data leave the local trust boundary and the skill description understates the breadth of what may be sent when combined with generic tool selection.
Content: Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.
md
13. Set `spider_name` to `linkedin.com`. 14. Set `spider_id` to the selected tool's `tool_sign`. 15. Always include `spider_errors=true` and `file_name={{TasksID}}`. 16. Return a curl command for `https://scraperapi.dataify.com/builder`. ## Set DATAIFY_API_TOKEN

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The reference section states the local catalog covers every tool in the scraper family, signaling that this skill can be driven as a family-wide wrapper rather than a single-purpose LinkedIn company collector. In an agent setting, such broad catalogs increase the chance of unauthorized scope drift and accidental misuse.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 83% confidence
Finding: The skill explicitly instructs the agent to prepare and send data to an external service endpoint using an API token. External transmission is expected for this integration, but it is still security-relevant because it can move user-supplied LinkedIn URLs and derived scraping parameters to a third-party service, with possible privacy, compliance, and data-handling implications.
Content: Scanner excerpt · SKILL.zh-CN.md (reported line 3)May include surrounding context.
md
--- name: "dataify-linkedin-company-information-by-url" description: "为 linkedin.com 上以 linkedin_company_information_by-url 为根的 scraper 系列准备 Dataify builder 请求。当需要处理成功的 Dataify scraper detail 条目 linkedin_company_information_by-url、让用户选择可用工具、读取已保存的 getToolParams 选项，并使用 DATAIFY_API_TOKEN 生成 scraperapi.dataify.com/builder curl 请求时，使用此 skill。" --- # Dataify Builder Skill 中文版

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The front matter markets a narrowly scoped company-information skill, but the body instructs the agent to offer a broader set of tools. This inconsistency creates a trust boundary problem: orchestration systems or users may authorize the skill based on the manifest while the content drives broader actions at runtime.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The instructions explicitly require the user to choose from a Chinese tool list and the document is framed as a Chinese-only workflow, but there is no opt-in or alternative locale path. This creates a language/locale policy issue because the skill imposes a specific language on the interaction without documented user choice or region-specific justification.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/task_runtime.py:38

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Description-Behavior Mismatch

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Description-Behavior Mismatch

Description-Behavior Mismatch

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

脚本用法

输出格式

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

脚本用法

输出格式

Description-Behavior Mismatch

Context-Inappropriate Capability

Description-Behavior Mismatch

Context-Inappropriate Capability

Context-Inappropriate Capability

Description-Behavior Mismatch

Undeclared Tool Scope

Natural-Language Policy Violations

External Transmission

Description-Behavior Mismatch

External Transmission

Intent-Code Divergence

Natural-Language Policy Violations

Static analysis

File appears to expose a hardcoded API secret or token.