Security audit
Security checks for vulnerabilities and agentic risk
The price-comparison skill is mostly coherent, but it handles a Dataify API token unsafely and bundles broader scraping/prospecting capabilities outside the stated price-only purpose.
Install only if you are comfortable using Dataify as a third-party processor for pricing research and with local raw-result retention. Treat the API token handling as a security issue: prefer rotating any token used with this version and avoid high-privilege or long-lived tokens until status/download authentication no longer places the token in URLs. Review the bundled non-price Amazon review and prospecting-related code before allowing broad or implicit invocation.
_dependencies/skills/scraper-amazon-comment/SKILL.zh-CN.md:8Localized Skill Instructions Force Promotional Output and Contradict the Account CTA Policy
scripts/wait_for_task.py:35Dataify API Token Is Transmitted in GET Query Strings
Polling third-party task-status endpoints, consuming environment tokens, and downloading arbitrary task JSON results indicates a general external scraper orchestration workflow rather than normalized price analysis. This is dangerous because it can expose user intent, targets, and retrieved data to an external provider and potentially return arbitrary data types under the guise of a benign pricing skill.
Polling third-party task-status endpoints, consuming environment tokens, and downloading arbitrary task JSON results indicates a general external scraper orchestration workflow rather than normalized price analysis. This is dangerous because it can expose user intent, targets, and retrieved data to an external provider and potentially return arbitrary data types under the guise of a benign pricing skill.
Polling third-party task-status endpoints, consuming environment tokens, and downloading arbitrary task JSON results indicates a general external scraper orchestration workflow rather than normalized price analysis. This is dangerous because it can expose user intent, targets, and retrieved data to an external provider and potentially return arbitrary data types under the guise of a benign pricing skill.
Polling third-party task-status endpoints, consuming environment tokens, and downloading arbitrary task JSON results indicates a general external scraper orchestration workflow rather than normalized price analysis. This is dangerous because it can expose user intent, targets, and retrieved data to an external provider and potentially return arbitrary data types under the guise of a benign pricing skill.
Polling third-party task-status endpoints, consuming environment tokens, and downloading arbitrary task JSON results indicates a general external scraper orchestration workflow rather than normalized price analysis. This is dangerous because it can expose user intent, targets, and retrieved data to an external provider and potentially return arbitrary data types under the guise of a benign pricing skill.
Polling third-party task-status endpoints, consuming environment tokens, and downloading arbitrary task JSON results indicates a general external scraper orchestration workflow rather than normalized price analysis. This is dangerous because it can expose user intent, targets, and retrieved data to an external provider and potentially return arbitrary data types under the guise of a benign pricing skill.
Polling third-party task-status endpoints, consuming environment tokens, and downloading arbitrary task JSON results indicates a general external scraper orchestration workflow rather than normalized price analysis. This is dangerous because it can expose user intent, targets, and retrieved data to an external provider and potentially return arbitrary data types under the guise of a benign pricing skill.
Polling third-party task-status endpoints, consuming environment tokens, and downloading arbitrary task JSON results indicates a general external scraper orchestration workflow rather than normalized price analysis. This is dangerous because it can expose user intent, targets, and retrieved data to an external provider and potentially return arbitrary data types under the guise of a benign pricing skill.
Polling third-party task-status endpoints, consuming environment tokens, and downloading arbitrary task JSON results indicates a general external scraper orchestration workflow rather than normalized price analysis. This is dangerous because it can expose user intent, targets, and retrieved data to an external provider and potentially return arbitrary data types under the guise of a benign pricing skill.
Polling third-party task-status endpoints, consuming environment tokens, and downloading arbitrary task JSON results indicates a general external scraper orchestration workflow rather than normalized price analysis. This is dangerous because it can expose user intent, targets, and retrieved data to an external provider and potentially return arbitrary data types under the guise of a benign pricing skill.
Polling third-party task-status endpoints, consuming environment tokens, and downloading arbitrary task JSON results indicates a general external scraper orchestration workflow rather than normalized price analysis. This is dangerous because it can expose user intent, targets, and retrieved data to an external provider and potentially return arbitrary data types under the guise of a benign pricing skill.
The skill file's declared purpose is task monitoring and token setup, which is materially different from the parent price-intelligence skill context. This kind of capability mismatch can cause the agent to invoke unrelated operational behaviors, including credential-handling and task execution flows, increasing the risk of unintended actions and confused-deputy behavior.
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
ershell $env:DATAIFY_API_TOKEN = "YOUR_TOKEN" if ($env:DATAIFY_API_TOKEN) { "configured" } else { "missing" }
Windows Command Prompt:
```cmd
set DATAIFY_API_TOKEN=YOUR_TOKEN
if defined DATAIFY_API_TOKEN (echo configured) else (echo missing)
macOS zsh:
echo 'export DATAIFY_API_TOKEN="YOUR_TOKEN"' >> ~/.zshrc
source ~/.zshrc
Linux bash:
echo 'export DATAIFY_API_TOKEN="YOUR_TOKEN"' >> ~/.bashrc
source ~/.bashrc
Windows PowerShell user environment:
[Environment]::SetEnvironmentVariable("DATAIFY_API_TOKEN", "YOUR_TOKEN", "User")
Windows Command Prompt user environment:
setx DATAIFY_API_TOKEN "YOUR_TOKEN"
Persistent changes affect new processes. Tell the user to open a new terminal or restart the agent application when the active process cannot see the updated value.
.envRecommend a project .env only when the actual command explicitly loads it. Creating the file alone does n
The code includes lead-intelligence prospecting against LinkedIn and Crunchbase, which is materially unrelated to price comparison and broadens the skill into company profiling. In the context of a price-intelligence skill, this hidden capability is more dangerous because it can be used for undisclosed target discovery and enrichment beyond the declared purpose.
The manifest describes a skill for comparing prices across sellers and producing normalized price findings, but this CLI is a generic catalog-driven task submitter that accepts arbitrary tool signatures and parameter payloads, then returns the final result from the remote builder. Nothing in this file constrains execution to price monitoring or price normalization, so its actual behavior is materially broader than the stated skill purpose.
By loading a tool catalog, selecting any tool by --tool-sign, and submitting it to the remote builder API, the file provides a general remote orchestration capability. For a skill whose stated purpose is limited to price comparison and normalized price findings, enabling arbitrary catalog tool execution is broader than necessary and not justified by the manifest description.
The embedded skill’s declared purpose is Amazon review extraction, which is materially unrelated to the parent skill’s stated price-intelligence scope. This capability mismatch can cause an agent to invoke a data-collection workflow outside user expectations or approved boundaries, increasing the risk of unauthorized scraping, policy bypass, and scope confusion in downstream automation.
The file’s declared behavior is Amazon review scraping, which materially conflicts with the parent skill’s stated purpose of price intelligence and normalized price findings. This scope mismatch is dangerous because it can smuggle unrelated data-collection behavior into an agent that users and operators would reasonably expect to only handle pricing, undermining consent, review boundaries, and least-privilege assumptions.
The skill explicitly enables Amazon review/comment collection even though that capability is not justified by the surrounding price-intelligence use case. In context, this represents unauthorized capability expansion: an agent invoked for pricing could be steered into collecting broader marketplace content, increasing legal/compliance exposure and violating user expectations about what data is being gathered.
The agent interface is scoped to collecting Amazon comment data, but the parent skill is described as price intelligence for comparing and normalizing seller pricing. This capability mismatch can cause the agent to invoke a data-collection path unrelated to the user's expected task, increasing the risk of unauthorized scraping, misleading outputs, or hidden secondary behavior under an apparently pricing-focused skill.
The script's core behavior is to submit an Amazon comment scraping job (spider_id: amazon_comment_by-url) even though the enclosing skill is ներկայացված as a price-intelligence tool for multi-seller price comparison. This hidden capability mismatch is dangerous because it can cause users or orchestrators to invoke unrelated data collection under false pretenses, enabling unauthorized scraping workflows and bypassing policy or review gates tied to the advertised skill purpose.
The code contains lead-generation and company-qualification logic, including searches against LinkedIn and Crunchbase plus scoring of companies for hiring and role fit. In a price intelligence skill, this is a strong scope deviation that could be exploited to perform prospecting or recruitment intelligence under a misleading package, creating privacy, compliance, and unauthorized-use risk.
The skill declares no explicit tool restrictions even though its documented behavior and referenced scripts imply access to environment variables, filesystem, shell, and network. In an agent setting, missing scope boundaries increases the blast radius of misuse or prompt-driven abuse because the runtime may permit more capabilities than the user expects.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
## Account CTA policy
- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
## Account CTA policy
- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
Detected: suspicious.exposed_secret_literal