ClawHub
Back to skill

Security audit

Dataify Review Intelligence

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches review analysis, but it handles the Dataify API token in a way that could expose it in service logs, so it should be reviewed before installing.

Install only if you trust the publisher and Dataify with the public URLs, collected review data, and a Dataify API token. Prefer a limited or easily rotated token, monitor credit usage, avoid private or sensitive URLs, and be aware that the current task polling/download code sends the token in URL query parameters that may be logged by the service or infrastructure.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/wait_for_task.py:103
Finding

Dataify API Token Transmitted in URL Query Strings

Content
View full analysis

Vulnerability Details

File Location: scripts/wait_for_task.py:103-107 and scripts/wait_for_task.py:129-133
Vulnerability Type: Sensitive credential exposure through URL query parameters
Risk Level: Medium

Vulnerable Code

python
payload = request_json(
    STATUS_ENDPOINT,
    {"api_key": api_key, "task_id": task_id},
    api_key,
    request_timeout,
)
python
return request_json(
    DOWNLOAD_ENDPOINT,
    {"api_key": api_key, "task_id": task_id, "type": "json"},
    api_key,
    request_timeout,
)

The parameters are converted into a URL by request_json():

python
def request_json(endpoint, params, api_key, timeout):
    url = endpoint + "?" + urllib.parse.urlencode(params)
    request = urllib.request.Request(url, method="GET")
    try:
        with urllib.request.urlopen(request, timeout=timeout) as response:
            content = response.read()

Technical Analysis

The API token is inserted into the api_key query parameter for both task-status and result-download requests. Although HTTPS protects the URL while it is transported over the network, it does not prevent the complete URL from being recorded by the destination service, reverse proxies, web application firewalls, monitoring infrastructure, exception telemetry, or debugging tools.

The response-body redaction at lines 60-61 does not mitigate this exposure because it only replaces the token in returned response text. It does not remove the token from the request URL or from infrastructure logs generated before a response is received.

Authentication secrets should be sent in an authorization header rather than in a URL. The behavior is functionally related to task monitoring, but exposing the credential through query parameters exceeds the minimum disclosure required to authenticate the request.

Attack Path

  1. A user configures DATAIFY_API_TOKEN and runs a workflow that ...[truncated 1089 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove api_key from all URL query dictionaries.
  2. Send the token in an authorization header:
    python
    def request_json(endpoint, params, api_key, timeout):
    url = endpoint + "?" + urllib.parse.urlencode(params)
    request = urllib.request.Request(
        url,
        headers={"Authorization": "Bearer {}".format(api_key)},
        method="GET",
    )
  3. Call the function with only non-secret parameters:
    python
    {"task_id": task_id}
    and:
    python
    {"task_id": task_id, "type": "json"}
  4. Ensure application, proxy, and telemetry configurations redact authorization headers.
  5. Avoid including request objects or headers in exception messages and debug output.
  6. Rotate tokens that may previously have been recorded in URL logs.
  7. Review historical server, proxy, and observability logs for exposed api_key parameters and securely delete or restrict those records where retention requirements permit.

T09 · Insecure Skill Coding Practices

Warning
Location
_dependencies/skills/dataify-task-operations/scripts/wait_for_task.py:103
Finding

Duplicated Task Runtime Exposes Dataify API Token in URL Query Strings

Content
View full analysis

Vulnerability Details

File Location: _dependencies/skills/dataify-task-operations/scripts/wait_for_task.py:103-107 and _dependencies/skills/dataify-task-operations/scripts/wait_for_task.py:129-133
Vulnerability Type: Sensitive credential exposure through URL query parameters
Risk Level: Medium

Vulnerable Code

python
payload = request_json(
    STATUS_ENDPOINT,
    {"api_key": api_key, "task_id": task_id},
    api_key,
    request_timeout,
)
python
return request_json(
    DOWNLOAD_ENDPOINT,
    {"api_key": api_key, "task_id": task_id, "type": "json"},
    api_key,
    request_timeout,
)

The duplicated helper places every parameter into the request URL:

python
def request_json(endpoint, params, api_key, timeout):
    url = endpoint + "?" + urllib.parse.urlencode(params)
    request = urllib.request.Request(url, method="GET")
    try:
        with urllib.request.urlopen(request, timeout=timeout) as response:
            content = response.read()

Technical Analysis

This bundled dependency contains the same credential-handling flaw as the top-level runtime. The API token is serialized into the URL for task-status and download requests.

TLS prevents passive observers from reading the encrypted request, but URL-based secrets remain vulnerable to storage in access logs, reverse-proxy logs, monitoring systems, and error telemetry. Redacting the token from response text does not protect the outgoing URL.

Because the main workflow can load scripts from the bundled dependency, correcting only the top-level copy would leave an exploitable execution path in packaged or standalone deployments.

Attack Path

  1. The bundled task-operations runtime is invoked to monitor a submitted task.
  2. It creates a GET URL containing the user's Dataify token as api_key.
  3. Dataify infrastructure or an intermediary logging system records the complete URL.

...[truncated 618 chars]

Remediation
View remediation

Remediation Suggestions

  1. Apply the authorization-header fix to the bundled dependency as well as the top-level copy.
  2. Remove api_key from task-status and download query parameters.
  3. Use an Authorization: Bearer header if supported by the Dataify API.
  4. If the remote API currently requires query authentication, update the API contract or use a short-lived, narrowly scoped request token rather than the long-lived account token.
  5. Add automated tests that fail when secrets appear in generated URLs, logs, exceptions, or dry-run output.
  6. Centralize the runtime implementation to prevent security fixes from diverging between duplicated files.
  7. Rotate potentially exposed credentials and review URL-bearing logs for historical leakage.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (56)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill’s stated boundary forbids mere raw comment downloading, yet the detected implementation can poll external scraper status APIs, download task JSON, and use an API token to retrieve scraping results. That is a strong trust-boundary violation because the declared safe use case masks a much broader data extraction pipeline.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The skill’s stated boundary forbids mere raw comment downloading, yet the detected implementation can poll external scraper status APIs, download task JSON, and use an API token to retrieve scraping results. That is a strong trust-boundary violation because the declared safe use case masks a much broader data extraction pipeline.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill’s stated boundary forbids mere raw comment downloading, yet the detected implementation can poll external scraper status APIs, download task JSON, and use an API token to retrieve scraping results. That is a strong trust-boundary violation because the declared safe use case masks a much broader data extraction pipeline.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill’s stated boundary forbids mere raw comment downloading, yet the detected implementation can poll external scraper status APIs, download task JSON, and use an API token to retrieve scraping results. That is a strong trust-boundary violation because the declared safe use case masks a much broader data extraction pipeline.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill’s stated boundary forbids mere raw comment downloading, yet the detected implementation can poll external scraper status APIs, download task JSON, and use an API token to retrieve scraping results. That is a strong trust-boundary violation because the declared safe use case masks a much broader data extraction pipeline.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill’s stated boundary forbids mere raw comment downloading, yet the detected implementation can poll external scraper status APIs, download task JSON, and use an API token to retrieve scraping results. That is a strong trust-boundary violation because the declared safe use case masks a much broader data extraction pipeline.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill’s stated boundary forbids mere raw comment downloading, yet the detected implementation can poll external scraper status APIs, download task JSON, and use an API token to retrieve scraping results. That is a strong trust-boundary violation because the declared safe use case masks a much broader data extraction pipeline.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The skill’s stated boundary forbids mere raw comment downloading, yet the detected implementation can poll external scraper status APIs, download task JSON, and use an API token to retrieve scraping results. That is a strong trust-boundary violation because the declared safe use case masks a much broader data extraction pipeline.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The skill’s stated boundary forbids mere raw comment downloading, yet the detected implementation can poll external scraper status APIs, download task JSON, and use an API token to retrieve scraping results. That is a strong trust-boundary violation because the declared safe use case masks a much broader data extraction pipeline.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill’s stated boundary forbids mere raw comment downloading, yet the detected implementation can poll external scraper status APIs, download task JSON, and use an API token to retrieve scraping results. That is a strong trust-boundary violation because the declared safe use case masks a much broader data extraction pipeline.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill’s stated boundary forbids mere raw comment downloading, yet the detected implementation can poll external scraper status APIs, download task JSON, and use an API token to retrieve scraping results. That is a strong trust-boundary violation because the declared safe use case masks a much broader data extraction pipeline.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · _dependencies/skills/dataify-task-operations/references/token-setup.md (reported line 48)May include surrounding context.

ershell $env:DATAIFY_API_TOKEN = "YOUR_TOKEN" if ($env:DATAIFY_API_TOKEN) { "configured" } else { "missing" }

text

Windows Command Prompt:

```cmd
set DATAIFY_API_TOKEN=YOUR_TOKEN
if defined DATAIFY_API_TOKEN (echo configured) else (echo missing)

Persistent configuration

macOS zsh:

bash
echo 'export DATAIFY_API_TOKEN="YOUR_TOKEN"' >> ~/.zshrc
source ~/.zshrc

Linux bash:

bash
echo 'export DATAIFY_API_TOKEN="YOUR_TOKEN"' >> ~/.bashrc
source ~/.bashrc

Windows PowerShell user environment:

powershell
[Environment]::SetEnvironmentVariable("DATAIFY_API_TOKEN", "YOUR_TOKEN", "User")

Windows Command Prompt user environment:

cmd
setx DATAIFY_API_TOKEN "YOUR_TOKEN"

Persistent changes affect new processes. Tell the user to open a new terminal or restart the agent application when the active process cannot see the updated value.

Project .env

Recommend a project .env only when the actual command explicitly loads it. Creating the file alone does n

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code supports prospecting and qualification of companies via LinkedIn and Crunchbase, including scoring and hiring-signal extraction, which is unrelated to review analysis. In this skill context, that represents unauthorized expansion into lead-generation behavior and can facilitate privacy-invasive or policy-violating enrichment beyond user expectations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script accepts an arbitrary --tool-sign, looks up the corresponding catalog entry, and submits the resulting builder task using the account's API token. In a skill advertised for review/public feedback analysis, this creates a broad remote task-submission capability that is not constrained to the declared purpose, enabling misuse of the skill to invoke unrelated scraping or processing jobs against external systems.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest context for this skill family says it should analyze reviews or public customer feedback across multiple sources to produce themes, sentiment signals, and product actions, and explicitly says not to use it to download raw comments from only one named platform without analysis. This skill instead declares itself as collecting Amazon reviews from product URLs and the rest of the document is entirely about submission, polling, and retrieval of extracted review data, with no analysis functionality.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

These lines specify that the default deliverable is the collected result, including downloading and returning the final JSON payload, and stopping only for submission-only requests. That is inconsistent with a review-intelligence skill whose described purpose is analysis and action-oriented synthesis rather than raw data retrieval.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The dependency skill is explicitly designed for single-platform Amazon review scraping and task submission, which conflicts with the parent skill’s stated purpose of multi-source review analysis rather than raw platform-specific collection. This scope drift can cause the agent to perform data acquisition outside the expected trust boundary, increasing the chance of policy violations, misuse, or user surprise.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill metadata advertises collecting Amazon comments directly, which conflicts with the parent skill's stated purpose of multi-source review analysis rather than raw single-platform collection. This mismatch can cause an agent to invoke a scraping-style dependency in contexts where the user asked for higher-level analysis, increasing the risk of policy bypass, unintended data collection, and use outside the intended scope.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The code explicitly submits an Amazon-specific comment scraping task, which conflicts with the skill's stated purpose of analyzing reviews across multiple sources and its warning not to download raw comments from a single named platform without analysis. In this context, the issue is dangerous because it enables targeted raw data collection outside the declared scope, increasing the risk of policy bypass, misuse for bulk scraping, and collection of data without the intended analytical safeguards.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifested skill purpose is review and public-feedback analysis, but the code's shared configuration and action generation support a separate lead mode that searches LinkedIn and Crunchbase for target companies and scores qualification signals. Prospect discovery and company-fit scoring are not justified by the stated review-mining and voice-of-customer purpose.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill advertises executable behavior involving environment access, file I/O, networking, and shell usage, but it does not declare any explicit tool scope or permission boundaries. That makes the operational trust boundary unclear and increases the risk of overbroad execution, especially because the workflow includes token handling and remote task submission.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md
## Account CTA policy

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · _dependencies/skills/dataify-task-operations/SKILL.md (reported line 75)May include surrounding context.

md
## Account CTA policy

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · _dependencies/skills/scraper-amazon-comment/SKILL.md (reported line 125)May include surrounding context.

md
## Account CTA policy

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · _dependencies/skills/scraper-amazon-comment/SKILL.zh-CN.md (reported line 107)May include surrounding context.

md
## Account CTA policy

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.