ClawHub
Back to skill

Security audit

Dataify MCP

Security checks for vulnerabilities and agentic risk

Overview

The skill is presented as an MCP setup helper, but it also ships under-documented Dataify scraping and business-workflow execution tools and can persist API tokens in plaintext configuration files.

Review this before installing. Use it only if you are comfortable granting a Dataify API token to the skill, having that token written into MCP client configuration URLs and possible backup files, and receiving bundled scripts that can run authenticated scraping/task workflows outside the documented setup path. Prefer a narrowly scoped token and rotate it if it has already been stored in readable config or backup files.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/configure_mcp.py:117
Finding

API Token Persisted in Plaintext URL Configuration and Backup Files

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/wait_for_task.py:35
Finding

API Token Sent in GET Query Parameters During Task Polling and Download

Content
View full analysis
` for every task-status poll and final download. HTTPS encrypts the URL while it is in transit, but it does not prevent the URL from being recorded at endpoints or intermediary systems. Query strings are commonly captured by: - Reverse-proxy and web-server access logs. - Application performance monitoring systems. - HTTP debugging and diagnostic tools. - Enterprise TLS inspection infrastructure. - Exception reports and network telemetry. - Browser or client history in implementations that expose request URLs. The response redaction performed later by `text.replace(api_key, "")` only modifies the response body. It does not sanitize the outbound request URL or logs generated before the response is processed. Polling repeats the exposure multiple times for a single task. ### Attack Path 1. A user submits a Dataify task and invokes the wait workflow. 2. `wait_for_task` repeatedly c ...[truncated 1251 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (20)

Tainted flow: 'followup' from os.environ.get (line 67, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/configure_mcp.py (reported line 68)May include surrounding context.

python
headers['Mcp-Session-Id'] = session
                for message in ({'jsonrpc':'2.0','method':'notifications/initialized'}, {'jsonrpc':'2.0','id':2,'method':'tools/list','params':{}}):
                    followup=urllib.request.Request(url,data=json.dumps(message).encode(),headers=headers,method='POST')
                    with urllib.request.urlopen(followup,timeout=timeout) as reply:
                        if message.get('id') == 2:
                            raw=reply.read(1024*1024).decode('utf-8')
                            try:

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Monitoring scraping jobs and downloading results from Dataify endpoints is operational data extraction behavior, not MCP setup. This is dangerous because it couples authenticated scraping and result retrieval with a trusted configuration helper, potentially causing unexpected external data access, storage, and billing activity.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

Monitoring scraping jobs and downloading results from Dataify endpoints is operational data extraction behavior, not MCP setup. This is dangerous because it couples authenticated scraping and result retrieval with a trusted configuration helper, potentially causing unexpected external data access, storage, and billing activity.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

Monitoring scraping jobs and downloading results from Dataify endpoints is operational data extraction behavior, not MCP setup. This is dangerous because it couples authenticated scraping and result retrieval with a trusted configuration helper, potentially causing unexpected external data access, storage, and billing activity.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

Monitoring scraping jobs and downloading results from Dataify endpoints is operational data extraction behavior, not MCP setup. This is dangerous because it couples authenticated scraping and result retrieval with a trusted configuration helper, potentially causing unexpected external data access, storage, and billing activity.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Monitoring scraping jobs and downloading results from Dataify endpoints is operational data extraction behavior, not MCP setup. This is dangerous because it couples authenticated scraping and result retrieval with a trusted configuration helper, potentially causing unexpected external data access, storage, and billing activity.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The file implements full search, scraping, evidence collection, and report-generation workflows even though the skill metadata says the skill should only configure or verify MCP connectivity and should not perform ordinary search, scraping, or business analysis. That scope mismatch is dangerous because it can cause users to unknowingly run broad external collection and analysis under the guise of a setup-only skill, increasing the chance of unauthorized data access, unexpected network activity, and policy bypass.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

This code launches multiple auxiliary search and scraper scripts through subprocess based on workflow actions, enabling real data collection rather than MCP configuration. In the context of a setup-only skill, that hidden execution surface is dangerous because it can trigger scraping against external targets, inherit local environment secrets, and perform actions the user did not reasonably expect from the declared skill purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The direct_request function performs outbound POST requests to Dataify scraping endpoints for both search and page-unlocking operations, which exceeds the stated setup-only role. This is dangerous because a user invoking an MCP configuration skill could unknowingly initiate remote scraping and content retrieval, potentially violating user expectations, internal controls, or external site-use restrictions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

This file implements full standalone search and web-unlocking capabilities, including outbound HTTP requests to Dataify endpoints, response parsing, and URL extraction. That exceeds the stated MCP-configuration-only scope of the skill and creates a capability mismatch: a user or downstream agent could use the skill to perform ordinary browsing, scraping, or content retrieval under the guise of setup, increasing the chance of unauthorized data collection or policy bypass.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill declares no explicit tool scope or permission boundaries even though its documented workflow requires environment access, file inspection/modification, shell execution, and likely network use. In an agent setting, missing scope declarations increase the chance of over-privileged execution and make it harder for users or the platform to constrain what the skill may do.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md
## Account CTA policy

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md
- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
- For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management.
- During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The module docstring openly states that this file provides shared execution and evidence reporting for business skills, directly contradicting the declared metadata that the skill is only for MCP setup and not for ordinary search, scraping, or business analysis. This inconsistency is a strong signal of deceptive or at least unsafe packaging because it normalizes hidden operational behavior behind a benign setup label.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/business_workflow.py (reported line 180)May include surrounding context.

python
def execute_action(action: dict[str, Any], token: str) -> subprocess.CompletedProcess[str]:
    invocation = command(action)
    if len(invocation) > 1 and Path(invocation[1]).exists():
        return subprocess.run(invocation, capture_output=True, text=True, encoding="utf-8", errors="replace", check=False)
    if action.get('capability', '').startswith('scraper-'):
        return subprocess.CompletedProcess([], 1, '', 'Required platform scraper is not installed; install it before executing this action.')
    return direct_request(action, token)

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The code reads DATAIFY_API_TOKEN from the environment and uses it to authenticate remote collection requests, which is inconsistent with a setup-only skill. While reading an env var is common, in this context it becomes risky because the skill can convert a local secret into active authenticated scraping capability without the narrow scope promised by the manifest.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/catalog_builder.py (reported line 70)May include surrounding context.

python
def build_curl(tool, spider_parameters_json):
    return " \\\n".join([
        "curl -X POST '{}'".format(BUILDER_URL),
        "  -H 'Authorization: Bearer $DATAIFY_API_TOKEN'",
        "  -H 'Content-Type: application/x-www-form-urlencoded'",
        "  -d 'spider_name={}'".format(tool["spider_name"]),

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Confidence
75% confidence
Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/configure_mcp.py (reported line 176)May include surrounding context.

python
return 0
    token = os.environ.get("DATAIFY_API_TOKEN", "").strip()
    if not token:
        print("DATAIFY_API_TOKEN is not configured. See https://dashboard.dataify.com/login?utm_source=skill.", file=__import__("sys").stderr)
        return 1
    tools = validate_tools(args.tools.split(",") if args.tools else tools_for_capability(args.capability) if args.capability else list(PRESETS[args.preset]))
    if target is None:

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Confidence
75% confidence
Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/configure_mcp.py (reported line 192)May include surrounding context.

python
configured_url = "https://mcp.dataify.com/mcp?token={}&tools={}".format(quote(token, safe=""), ",".join(tools))
            result["verification"] = verify_server(configured_url)
    except (OSError, ValueError, RuntimeError) as exc:
        print(str(exc), file=__import__("sys").stderr)
        return 2
    print(json.dumps(result, ensure_ascii=False, indent=2))
    return 0 if result.get('verification', {}).get('status', 'ready') == 'ready' else 2

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The module docstring explicitly advertises a standalone Dataify HTTP client, which contradicts the declared purpose of a skill limited to MCP configuration and tool selection. This mismatch is dangerous because it signals and normalizes broader operational use, making it easier for the skill to be repurposed for general search or scraping workflows outside its approved context.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/task_runtime.py:38