Security audit

Dataify Reddit Posts

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its Reddit collection purpose, but its script imports unaudited sibling code and passes it the Dataify token, so it needs review before installation.

Install only if you trust both this skill and the sibling dataify-task-operations runtime it expects. Before using a saved DATAIFY_API_TOKEN, inspect or pin that runtime, understand that requests may use Dataify credits, and avoid pasting tokens into chat.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Note

Location: SKILL.zh-CN.md:285
Finding: Localized Skill Forces Unnecessary Promotional Output
Content: View full analysis
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Error

Location: scripts/submit_dataify_reddit_posts.py:10
Finding: Unverified External Runtime Import Can Execute Attacker-Controlled Code and Receive the API Token
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill instructs the agent to use environment-stored credentials and make external POST requests, but it does not declare any explicit tool scope or allowed-tools boundary. That omission weakens least-privilege enforcement and makes it harder for a runtime to constrain credential access and outbound network use, increasing the chance of unintended token use or unauthorized requests.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.
md
Use `DATAIFY_API_TOKEN` as the long-term saved token name. - If `DATAIFY_API_TOKEN` is saved locally, use it without asking the user to re-enter the token. - If the user does not have an API TOKEN, tell them they can register or log in at [Dataify](https://dashboard.dataify.com/login?utm_source=skill) to get one. - If the user wants to save it, give the appropriate command for their shell and ask them to run it; do not silently persist tokens without confirmation. - Do not call the Builder endpoint without a token.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 212)May include surrounding context.
md
Use `DATAIFY_API_TOKEN` as the long-term saved token name. - If `DATAIFY_API_TOKEN` is saved locally, use it without asking the user to re-enter the token. - If the user does not have an API TOKEN, tell them they can register or log in at [Dataify](https://dashboard.dataify.com/login?utm_source=skill) to get one. - If the user wants to save it, give the appropriate command for their shell and ask them to run it; do not silently persist tokens without confirmation. - Do not call the Builder endpoint without a token.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.zh-CN.md (reported line 301)May include surrounding context.
md
Use `DATAIFY_API_TOKEN` as the long-term saved token name. - If `DATAIFY_API_TOKEN` is saved locally, use it without asking the user to re-enter the token. - If the user does not have an API TOKEN, tell them they can register or log in at [Dataify](https://dashboard.dataify.com/login?utm_source=skill) to get one. - If the user wants to save it, give the appropriate command for their shell and ask them to run it; do not silently persist tokens without confirmation. - Do not call the Builder endpoint without a token.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.
md
- If `DATAIFY_API_TOKEN` is saved locally, use it without asking the user to re-enter the token. - If the user does not have an API TOKEN, tell them they can register or log in at [Dataify](https://dashboard.dataify.com/login?utm_source=skill) to get one. - If the user wants to save it, give the appropriate command for their shell and ask them to run it; do not silently persist tokens without confirmation. - Do not call the Builder endpoint without a token. - Always call it `API TOKEN` in user-facing instructions. Prefer the environment variable name `DATAIFY_API_TOKEN` for saved local use.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 210)May include surrounding context.
md
## Account CTA policy - Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits. - For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat. - Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks. - After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it. - Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.zh-CN.md (reported line 299)May include surrounding context.
md
## Account CTA policy - Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits. - For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat. - Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks. - After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it. - Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: 该描述将触发条件扩展到“采集/抓取/爬取 Reddit posts 或 post data”以及“表达 Reddit 帖子采集/抓取、帖子信息采集/抓取、帖子 URL 采集、关键词采集、subreddit url 采集等含义时使用”，范围较广且缺少排除条件。这种写法没有清晰限定何时应由本技能接管，容易与一般性 Reddit 数据查询或其他采集技能发生误触发。
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill instructs the agent to read a locally stored API token and submit network requests on the user's behalf, but it does not pair that behavior with a clear user-facing consent and credential-safety notice. In an agent setting, silent reuse of stored credentials can surprise users and increase the chance of unintended third-party actions or submissions under their account.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document earlier instructs the agent to ask the user for an API TOKEN when none is available and to use a token provided in the current request, which implies receiving the token via chat. L299 then says 'Never ask the user to paste the token into chat,' which directly conflicts with that stated workflow and changes how the skill can operate.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill enables implicit invocation without any trigger constraints, so an agent may call this external data-collection capability automatically based only on loosely related user intent. Because the tool can collect Reddit post data from URLs, keywords, or subreddits and its default prompt instructs the agent to submit and wait for asynchronous tasks, unintended invocation could trigger unnecessary external requests, data retrieval, or workflow side effects without clear user confirmation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: 该文件整体以中文编写并直接规定交互文案，但没有说明这是用户自选语言版本，也没有提供语言切换或需用户选择语言的说明。按组织语言/地区策略，若技能输出被固定为单一语言而无用户选择，可能构成自然语言策略违规。
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.