Security audit

Dataify Scraper Builder

Security checks for vulnerabilities and agentic risk

Overview

The scraper-builder behavior is partly coherent, but the package also includes undisclosed business-intelligence collection workflows and has credential and URL-handling risks that warrant review before installation.

Install only if you are comfortable with a Dataify skill that can send target URLs, queries, and task identifiers to Dataify services and write fetched samples/results into your workspace. Review or remove the business_workflow.py path if you only want scraper generation, and prefer short-lived or least-privilege Dataify API tokens because one polling script places the token in request URLs.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/wait_for_task.py:34
Finding: API Token Exposed in HTTP Query Strings During Task Polling and Result Download
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/dataify_client.py:34
Finding: Public-URL Validation Allows Private, Loopback, Link-Local, and Metadata Targets
Content: View full analysis
str: value = value.strip() parts = urlsplit(value) if parts.scheme not in {"http", "https"} or not parts.netloc: raise ValueError("A public HTTP(S) URL is required") if parts.username or parts.password or not re.fullmatch(r"[A-Za-z0-9.-]+(?::\d+)?", parts.netloc): raise ValueError("URL credentials or invalid host names are not allowed") return value ``` The accepted URL is then submitted to the remote rendering service: ```python def unlock(url: str, token: str, geography: str = "us", clean_content: bool = True, timeout: float = 120) -> dict[str, Any]: payload = { "url": normalize_url(url), "type": "html", "js_render": "True", "clean_content": "true" if clean_content else "false", "country": geography.lower(), "follow_redirect": "True", "isjson": "1", } return _post(UNLOCKER_ENDPOINT, token, json.dumps(payload).encode("utf-8"), "application/json", timeout) ``` The generated scraper performs no equivalent URL validation before submission: ```python payload = json.dumps({{"url": args.url, "type": "html", "js_render": "True", "clean_content": "false", "follow_redirect": "True", "isjson": "1"}}).encode("utf-8") request = urllib.request.Request(ENDPOINT, data=payload, headers={{"Authorization": "Bearer " + token, "Content-Type": "application/json"}}, method="POST") try: with urllib.request.urlopen(request, timeou ...[truncated 3820 chars]
Remediation: View remediation
None: if hostname.casefold() == "localhost" or hostname.casefold().endswith(".localhost"): raise ValueError("Local destinations are not allowed") results = socket.getaddrinfo(hostname, None, type=socket.SOCK_STREAM) addresses = {item[4][0] for item in results} for raw_address in addresses: address = ipaddress.ip_address(raw_address) if not address.is_global: raise ValueError("Only public Internet destinations are allowed") ``` 3. Apply the check to literal IPv4 and IPv6 addresses as well as DNS names. 4. Revalidate the destination after DNS resolution and immediately before connection to reduce DNS-rebinding exposure. 5. Validate every redirect target. Do not rely solely on initial-URL validation when `follow_redirect` is enabled. 6. Apply identical controls in: - `dataify_client.unlock()` - Generated scraper source - `business_workflow.direct_request()` - User-provided `--source-url` processing - Any discovered URLs that become detail actions 7. Normalize and validate ports, rejecting unexpected or prohibited destination ports where they are not required by the declared scraping functionality. 8. Enforce the same restrictions at the Dataify Web Unlocker service. Client-side validation alone cannot securely prevent DNS rebinding or redirect manipulation because the remote service performs the actual network connection. 9. Add automated tests covering: - Loopback IPv4 and IPv6 - RFC1918 private ranges - Link-local and cloud metadata addresses - Reserved, multicast, and unspecified addresses - Hostnames resolving to private addresses - ...[truncated 113 chars]

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The finding suggests the skill may monitor/download results for existing Dataify tasks using API tokens and task IDs rather than inspect target websites or design scrapers. That creates a serious transparency issue: a user may believe they are invoking a limited analysis tool while the skill actually accesses account-scoped remote resources and external service endpoints.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The finding suggests the skill may monitor/download results for existing Dataify tasks using API tokens and task IDs rather than inspect target websites or design scrapers. That creates a serious transparency issue: a user may believe they are invoking a limited analysis tool while the skill actually accesses account-scoped remote resources and external service endpoints.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The finding suggests the skill may monitor/download results for existing Dataify tasks using API tokens and task IDs rather than inspect target websites or design scrapers. That creates a serious transparency issue: a user may believe they are invoking a limited analysis tool while the skill actually accesses account-scoped remote resources and external service endpoints.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The finding suggests the skill may monitor/download results for existing Dataify tasks using API tokens and task IDs rather than inspect target websites or design scrapers. That creates a serious transparency issue: a user may believe they are invoking a limited analysis tool while the skill actually accesses account-scoped remote resources and external service endpoints.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The finding suggests the skill may monitor/download results for existing Dataify tasks using API tokens and task IDs rather than inspect target websites or design scrapers. That creates a serious transparency issue: a user may believe they are invoking a limited analysis tool while the skill actually accesses account-scoped remote resources and external service endpoints.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file defines a generic business-intelligence workflow with modes for price, review, lead, and brand monitoring, which is materially broader than the declared purpose of a scraper-builder skill. This capability mismatch is dangerous because it enables collection and analysis workflows that users and reviewers would not reasonably expect from this skill, increasing the chance of unauthorized data gathering and policy bypass through mis-scoped functionality.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Instead of designing a scraper specification, this code actively executes searches and scraping actions against external services and installed scraper modules. In the context of a scraper-builder skill, that is a significant scope violation because it turns a planning/design tool into an operational data-collection agent, potentially causing unintended outbound requests and data acquisition.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill declares no explicit tool scope even though its instructions clearly contemplate environment inspection, file operations, network access, and shell execution. Missing least-privilege boundaries makes it easier for an agent runtime to grant broader capabilities than necessary, increasing the blast radius if the skill is misused, compromised, or behaves unexpectedly.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.
md
## Account CTA policy - Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits. - For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat. - Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks. - After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it. - Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.
md
- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits. - For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat. - Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks. - After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it. - Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control. - For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management. - During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code saves the full retrieved page content to sample.html, which can persist user-requested or sensitive site data locally. There is no confirmation prompt, log message, or inline comment/docstring warning the user that remote content will be stored on disk.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The lead-generation logic targets LinkedIn and Crunchbase company pages and scores organizations for qualification, which is unrelated to building website scrapers. In this skill context, that unjustified prospecting capability expands the skill into business targeting and enrichment, increasing privacy, compliance, and misuse risk beyond the stated purpose.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The workflow sends user-provided queries and URLs to external Dataify endpoints and local scraper components without a clear runtime disclosure or confirmation at the moment of execution. This is risky because user-supplied targets may contain sensitive business interests, investigation subjects, or proprietary URLs, and transmitting them off-box without explicit notice can create privacy, confidentiality, and trust issues.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/business_workflow.py (reported line 180)May include surrounding context.
python
def execute_action(action: dict[str, Any], token: str) -> subprocess.CompletedProcess[str]: invocation = command(action) if len(invocation) > 1 and Path(invocation[1]).exists(): return subprocess.run(invocation, capture_output=True, text=True, encoding="utf-8", errors="replace", check=False) if action.get('capability', '').startswith('scraper-'): return subprocess.CompletedProcess([], 1, '', 'Required platform scraper is not installed; install it before executing this action.') return direct_request(action, token)

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The reporting layer produces business-intelligence outputs such as pricing ranges, review signals, qualification scores, and executive summaries, which goes well beyond scraper construction. This is dangerous in context because it operationalizes scraped data into decision-support artifacts under misleading skill metadata, making the actual data-processing behavior broader and less transparent than advertised.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/catalog_builder.py (reported line 70)May include surrounding context.
python
def build_curl(tool, spider_parameters_json): return " \\\n".join([ "curl -X POST '{}'".format(BUILDER_URL), " -H 'Authorization: Bearer $DATAIFY_API_TOKEN'", " -H 'Content-Type: application/x-www-form-urlencoded'", " -d 'spider_name={}'".format(tool["spider_name"]),

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script hard-codes Chinese status strings for task state handling, which creates a locale dependency that is not explained to the user and does not provide any opt-in or fallback behavior. This matches the language/locale policy concern because the skill implicitly assumes a specific language for API responses.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This operation creates generated_scraper.py on disk, which is a file write with lasting effects in the user's workspace. Although code generation is part of the tool's purpose, there is no visible disclosure in the execution flow that a new script file will be created at the target path.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/task_runtime.py:38