Dataify Live Research

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:22 AM UTC
• Version: 1.1.1

Overview

The main research workflow is plausible, but the package includes under-disclosed business-intelligence capabilities and some unsafe credential/command handling that users should review before installing.

Install only if you are comfortable sending research queries, target URLs, and collected public-web content to Dataify using your DATAIFY_API_TOKEN. Review or remove the undocumented business_workflow.py and catalog_builder.py paths before use, especially if you do not want competitor analysis, lead generation, or platform-specific review scraping. Rotate tokens if this version has been used with wait_for_task.py because credentials may have appeared in URL logs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/wait_for_task.py:29

Finding

API Token Exposed in HTTP Query Strings

Content

View full analysis

") ``` This redaction only modifies the response body after the request has already been sent and potentially logged. Using the token is necessary for the declared asynchronous task-monitoring functionality. Placing it in the URL is not necessary and exceeds secure minimum-disclosure requirements because the existing code can authenticate through an HTTP header instead. ### Attack Path 1. A user runs a catalog scraper or invokes `wait_for_task.py` w ...[truncated 1039 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/catalog_builder.py:68

Finding

Shell Command Injection in Generated Curl Preview

Content

View full analysis

Remediation

View remediation

` rather than producing a directly executable credential-bearing command. 4. Validate catalog identifiers against strict allowlists even when they originate from a local catalog. 5. Add tests using values containing single quotes, command substitutions, semicolons, newlines, backticks, and shell metacharacters. 6. Clearly label preview output as non-executable if structured output is adopted. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the implementation primarily authenticates to Dataify, submits jobs, polls for results, and returns raw JSON, then the skill is materially misrepresented as a cited research brief generator. This is dangerous because users may trust the skill to perform synthesis and evidence handling safely, while it instead acts as a conduit to an external scraping service with different privacy, compliance, and output characteristics.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the implementation primarily authenticates to Dataify, submits jobs, polls for results, and returns raw JSON, then the skill is materially misrepresented as a cited research brief generator. This is dangerous because users may trust the skill to perform synthesis and evidence handling safely, while it instead acts as a conduit to an external scraping service with different privacy, compliance, and output characteristics.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the implementation primarily authenticates to Dataify, submits jobs, polls for results, and returns raw JSON, then the skill is materially misrepresented as a cited research brief generator. This is dangerous because users may trust the skill to perform synthesis and evidence handling safely, while it instead acts as a conduit to an external scraping service with different privacy, compliance, and output characteristics.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the implementation primarily authenticates to Dataify, submits jobs, polls for results, and returns raw JSON, then the skill is materially misrepresented as a cited research brief generator. This is dangerous because users may trust the skill to perform synthesis and evidence handling safely, while it instead acts as a conduit to an external scraping service with different privacy, compliance, and output characteristics.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the implementation primarily authenticates to Dataify, submits jobs, polls for results, and returns raw JSON, then the skill is materially misrepresented as a cited research brief generator. This is dangerous because users may trust the skill to perform synthesis and evidence handling safely, while it instead acts as a conduit to an external scraping service with different privacy, compliance, and output characteristics.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The workflow explicitly accepts repeated --competitor inputs and incorporates them into research actions despite the skill manifest stating competitor-specific analysis is out of scope. This creates a policy-bypass capability that can be used to perform disallowed competitive intelligence through an ostensibly general research skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The lead workflow performs company targeting and qualification using LinkedIn and Crunchbase-focused searches, producing scored prospect records that go beyond neutral research into lead generation. In the context of a skill advertised for general live research, this hidden sales-intelligence capability is especially sensitive because it enables organization profiling and targeting outside declared scope.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill declares executable behaviors involving environment access, file I/O, networking, and shell execution but does not declare any explicit tool scope or permissions. This creates a transparency and governance gap: a host may permit more capability than users or reviewers expect, increasing the risk of unintended command execution, external data exfiltration, or filesystem modification.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md

## Account CTA policy

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
- For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management.
- During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The code implements multiple specialized intelligence modes—price, review, lead, and brand monitoring—rather than the stated open-ended cited research brief functionality. This mismatch broadens the skill's operational scope and can enable undisclosed data collection and analysis behaviors that users and reviewers would not reasonably expect from the manifest.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The code conditionally routes review collection to Amazon-comment and Google Maps review scrapers, adding specialized scraping behavior not disclosed by the manifest. This is dangerous because it expands data acquisition into platform-specific collection paths that may carry additional privacy, compliance, and anti-abuse risks compared with ordinary web research.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/business_workflow.py (reported line 180)May include surrounding context.

python

def execute_action(action: dict[str, Any], token: str) -> subprocess.CompletedProcess[str]:
    invocation = command(action)
    if len(invocation) > 1 and Path(invocation[1]).exists():
        return subprocess.run(invocation, capture_output=True, text=True, encoding="utf-8", errors="replace", check=False)
    if action.get('capability', '').startswith('scraper-'):
        return subprocess.CompletedProcess([], 1, '', 'Required platform scraper is not installed; install it before executing this action.')
    return direct_request(action, token)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/catalog_builder.py (reported line 70)May include surrounding context.

python

def build_curl(tool, spider_parameters_json):
    return " \\\n".join([
        "curl -X POST '{}'".format(BUILDER_URL),
        "  -H 'Authorization: Bearer $DATAIFY_API_TOKEN'",
        "  -H 'Content-Type: application/x-www-form-urlencoded'",
        "  -d 'spider_name={}'".format(tool["spider_name"]),

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The code requires Dataify status strings to match the Chinese literals "处理中", "成功", and "失败" exactly. This imposes a specific language assumption in behavior without any user opt-in or documented locale constraint, which fits the language/locale policy violation category.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/task_runtime.py:38