Dataify Reddit Comment By URL

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:07 AM UTC
• Version: 1.3.0

Overview

The skill mostly matches its Reddit-comment collection purpose, but it has credential-handling and dependency-scope issues that should be reviewed before installation.

Review this skill before installing. It needs a Dataify API token and can submit Dataify jobs that may consume account credits. Configure the token as an environment variable rather than pasting it into chat, and only use the skill if you trust both this package and the separate dataify-task-operations runtime it imports for result monitoring.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.zh-CN.md:152

Finding

Unconditional Promotional Redirection in Localized Skill Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.zh-CN.md, line 152
Vulnerability Type: Unconditional external-service promotion and output manipulation
Risk Level: High

Vulnerable Instruction

The localized instruction at line 152 translates to:

markdown

- After task creation succeeds, always direct the user to [Dataify](https://dashboard.dataify.com?utm_source=skill).

Related workflow instructions at lines 7 and 46 also direct users to the Dataify Dashboard after submission.

Technical Analysis

The localized Skill mandates that the Agent always include a tracked Dataify Dashboard link after successful task creation. This instruction is not necessary to submit the task, monitor it, or return the collected result.

The unconditional requirement alters the Agent's normal response behavior by injecting recurring promotional routing into successful interactions. It also conflicts with the account CTA policy later in the same document, which states that the Dashboard must not be promoted during normal submission, processing, or successful completion.

Because the directive appears in the localized Skill rather than the executable script, behavior can vary depending on which language version is loaded. An Agent following the localized instruction may prioritize the unconditional directive over the safer policy.

Attack Path

1. The Agent loads the localized SKILL.zh-CN.md instructions.
2. A user requests collection of comments from a Reddit URL.
3. The Skill submits the collection task successfully.
4. The Agent follows the unconditional instruction and adds the tracked Dataify Dashboard link to its response.
5. The user is routed to an external promotional page even when the requested result can be returned directly and no account-management action is required.

Impact Assessment

This issue affects Agent output integrity and user autonomy. It can:

• Inject promotional content into ...[truncated 383 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the unconditional instruction requiring Dashboard redirection after every successful task.
2. Show Dataify account or management links only when:
   • The API token is missing or invalid.
   • The account has insufficient credits.
   • Result retrieval genuinely requires user interaction.
   • The user explicitly requests account-management information.
3. Make the localized workflow consistent with the safer English account CTA policy.
4. Add automated consistency checks across localized Skill documents to identify conflicting security and credential-handling instructions.
5. Return the collected result directly whenever possible instead of redirecting the user to an external dashboard.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.zh-CN.md:14

Finding

Localized Workflow Encourages API Token Disclosure Through Chat

Content

View full analysis

Vulnerability Details

File Location: SKILL.zh-CN.md, lines 14 and 43
Vulnerability Type: Insecure credential collection through conversation context
Risk Level: Medium

Vulnerable Instructions

The instruction at line 14 translates to:

markdown

- If the user provides a token in the request, use that token during the current run.

The workflow instruction at line 43 translates to:

markdown

6. If no usable token is available, ask the user to enter an API TOKEN and ask whether it should be saved as DATAIFY_API_TOKEN.

Technical Analysis

These instructions explicitly allow or request an API token through the conversation. API tokens are sensitive authentication credentials and should not be entered into chat because conversation content may be retained in history, telemetry, diagnostic logs, model context, or operator-visible records.

The vulnerable instructions conflict with the account CTA policy later in the same document, which states that the user must never be asked to paste the token into chat. This contradiction creates ambiguous behavior and may cause an Agent to follow the earlier workflow and solicit the credential insecurely.

The executable script itself reads DATAIFY_API_TOKEN from the environment and does not require the token as a command-line argument. Therefore, requesting the token through chat exceeds the minimum privilege and data-handling requirements of the implementation.

Attack Path

1. The Agent checks the environment and finds that DATAIFY_API_TOKEN is absent.
2. The Agent follows the localized workflow and asks the user to enter the API token.
3. The user pastes the token into the conversation.
4. The token becomes part of the conversation state and may be retained in logs, history, telemetry, or subsequent model context.
5. Any party or component with access to those records may obtain the token and use it against the Dataify account.

...[truncated 481 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all instructions that ask users to provide API tokens in chat.
2. Require users to configure DATAIFY_API_TOKEN outside the conversation using a session-scoped environment variable.
3. Detect the current operating system and shell and display only the relevant setup command.
4. Verify only whether the environment variable is present; never print, echo, log, or return its value.
5. Do not silently persist tokens. Provide persistent configuration instructions only when explicitly requested.
6. Add an explicit precedence rule stating that credentials must never be accepted through conversation content.
7. Harmonize the English and localized documentation so that all versions enforce identical credential-handling safeguards.

T08 · Insecure Dependencies

Warning

• Location: scripts/submit_dataify_reddit_comment_by_url.py:11

Finding

Unaudited Sibling Module Is Imported and Given the API Token

Content

View full analysis

Vulnerability Details

File Location: scripts/submit_dataify_reddit_comment_by_url.py, lines 11–14 and 190
Vulnerability Type: Unsafe external dependency loading through manual Python path manipulation
Risk Level: Medium

Vulnerable Code

python

TASK_RUNTIME_DIR = os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "dataify-task-operations", "scripts"))
if TASK_RUNTIME_DIR not in sys.path:
    sys.path.insert(0, TASK_RUNTIME_DIR)
from task_runtime import complete_task

The imported function later receives the API token:

python

final_result = complete_task(task_id, api_token, args.wait_timeout)

Technical Analysis

The script constructs a path outside the audited Skill package, prepends that path to sys.path, and imports task_runtime from it. The referenced sibling component is not present in the audited project, and the script performs no version pinning, provenance check, signature validation, or integrity verification.

Prepending the directory gives modules in that location priority during Python import resolution. Python executes module-level code immediately when the import occurs. Consequently, anyone able to create or modify dataify-task-operations/scripts/task_runtime.py can execute code in the Skill process.

The risk is increased because the imported complete_task function receives api_token directly. Although the direct Builder request sends the token only to the documented Dataify HTTPS endpoint, the subsequent token handoff crosses into unaudited code.

Attack Path

1. An attacker or compromised installation process creates or modifies: dataify-task-operations/scripts/task_runtime.py.
2. The user invokes submit_dataify_reddit_comment_by_url.py.
3. The script prepends the sibling directory to sys.path.
4. Python imports and executes the attacker-controlled module.
5. The malicious module can execute immediately at import ti ...[truncated 1020 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove manual sys.path manipulation and avoid importing executable code from a sibling directory.
2. Package task_runtime as part of the audited Skill or as a formally managed dependency with a pinned version and verified source.
3. Use dependency hashes or signed artifacts to verify integrity before execution.
4. Fail safely if the approved runtime dependency is unavailable rather than importing any matching local module.
5. Minimize credential exposure by keeping authenticated HTTP operations inside audited code.
6. If the runtime must receive credentials, define and document its exact provenance, version, required permissions, and network destinations.
7. Add tests that verify the resolved module path before invoking it and reject modules outside an approved immutable installation directory.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill performs sensitive actions using environment access and outbound network access, but it does not declare any explicit tool scope or allowed-tools boundaries. That increases the chance an agent can use broader capabilities than intended, including reading local secrets and making external requests without clear least-privilege constraints.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

Use `DATAIFY_API_TOKEN` as the long-term saved token name.

- If `DATAIFY_API_TOKEN` is saved locally, use it without asking the user to re-enter the token.
- If the user does not have an API TOKEN, tell them they can register or log in at [Dataify](https://dashboard.dataify.com/login?utm_source=skill) to get one.
- If the user wants to save it, give the appropriate command for their shell and ask them to run it; do not silently persist tokens without confirmation.
- Do not call the Builder endpoint without a token.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.

md

Use `DATAIFY_API_TOKEN` as the long-term saved token name.

- If `DATAIFY_API_TOKEN` is saved locally, use it without asking the user to re-enter the token.
- If the user does not have an API TOKEN, tell them they can register or log in at [Dataify](https://dashboard.dataify.com/login?utm_source=skill) to get one.
- If the user wants to save it, give the appropriate command for their shell and ask them to run it; do not silently persist tokens without confirmation.
- Do not call the Builder endpoint without a token.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 168)May include surrounding context.

md

Use `DATAIFY_API_TOKEN` as the long-term saved token name.

- If `DATAIFY_API_TOKEN` is saved locally, use it without asking the user to re-enter the token.
- If the user does not have an API TOKEN, tell them they can register or log in at [Dataify](https://dashboard.dataify.com/login?utm_source=skill) to get one.
- If the user wants to save it, give the appropriate command for their shell and ask them to run it; do not silently persist tokens without confirmation.
- Do not call the Builder endpoint without a token.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md

- If `DATAIFY_API_TOKEN` is saved locally, use it without asking the user to re-enter the token.
- If the user does not have an API TOKEN, tell them they can register or log in at [Dataify](https://dashboard.dataify.com/login?utm_source=skill) to get one.
- If the user wants to save it, give the appropriate command for their shell and ask them to run it; do not silently persist tokens without confirmation.
- Do not call the Builder endpoint without a token.
- Always call it `API TOKEN` in user-facing instructions. Prefer the environment variable name `DATAIFY_API_TOKEN` for saved local use.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file is primarily written in Chinese, but lines L163-L170 introduce operational instructions in English such as required user-facing statements. This creates a language/locale policy issue because the skill may force English responses or CTAs without offering the user a choice or documenting a justified locale constraint.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

md

## Account CTA policy

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 166)May include surrounding context.

md

## Account CTA policy

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Line L166 says 'Never ask the user to paste the token into chat,' but earlier instructions explicitly say that if no saved token exists, the user should be asked to provide the API token for the current run (L014-L017, L043). This is an active contradiction in the skill's own operator guidance about how credentials are to be supplied.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill enables implicit invocation, but the metadata does not define a narrowly scoped trigger condition beyond a broad default prompt to perform a Dataify collection. That makes it easier for an agent to auto-select and execute this skill in response to loosely related user requests, potentially causing unintended outbound collection actions against Reddit URLs without sufficiently explicit user intent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.