ClawHub
Back to skill

Security audit

Dataify Reddit Comment By URL

Security checks across malware telemetry and agentic risk

Overview

This skill clearly submits user-reviewed Reddit comment collection jobs to Dataify and uses a Dataify token for that purpose.

Install only if you intend to submit Reddit comment collection jobs to Dataify. Review the parameters before submission and understand that Reddit URLs and task settings will be sent to Dataify using your API TOKEN.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill explicitly instructs the agent to access a locally saved environment token and make outbound network requests, but no declared permissions are present. This creates a capability/consent gap: a host system may expose secrets or allow external calls without users realizing the skill needs those powers, increasing the chance of unintended token use or data egress.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The skill enables allow_implicit_invocation without any visible trigger constraints, exclusions, or confirmation requirements. Because this skill submits external Dataify Reddit comment collection tasks, broad implicit invocation can cause unintended tool execution from ambiguous user requests, leading to unauthorized API usage, unintended data collection, and reduced user control over external actions.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
- If the user provides a token in the request, use it for this run.
- If no token is provided, first check whether `DATAIFY_API_TOKEN` is already saved locally in the environment.
- If `DATAIFY_API_TOKEN` is saved locally, use it without asking the user to re-enter the token.
- If no token is available locally, tell the user they need to provide a Dataify API TOKEN.
- If the user does not have an API TOKEN, tell them they can register or log in at [Dataify](https://dashboard.dataify.com/login?utm_source=skill) to get one.
- If the user already has an API TOKEN, tell them it is available in the top-right area of [Dataify](https://dashboard.dataify.com?utm_source=skill).
Confidence
84% confidence
Finding
The instruction to use a saved DATAIFY_API_TOKEN 'without asking' authorizes the agent to perform an authenticated external action using previously stored credentials without fresh user approval. In a skill that submits scraping jobs to a third-party service, that can lead to unintended account usage, billable actions, or disclosure of user-provided targets to the external platform.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.