Dataify SEO Audit

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:28 AM UTC
• Version: 1.1.1

Overview

The SEO audit workflow is mostly understandable, but the package also includes unrelated business-intelligence and generic Dataify task tooling with credential and URL-handling risks.

Review before installing. Use only with public URLs and a limited Dataify token, expect target URLs, page content, and optional keywords to be sent to Dataify, and be aware that the package includes broader business-intelligence tooling not described by the SEO-audit name.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/wait_for_task.py:35

Finding

API Token Exposed in URL Query Strings During Task Polling

Content

View full analysis

") ``` That replacement only redacts the response body after the request has already been sent. It does not remove the credential from request URLs or provider-side logs. This exceeds the minimum credential exposure necessary for task polling because the project already uses an `Authorization: Bearer` header for o ...[truncated 1069 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/dataify_client.py:34

Finding

Public URL Validation Does Not Reject Private or Internal Destinations

Content

View full analysis

str: value = value.strip() parts = urlsplit(value) if parts.scheme not in {"http", "https"} or not parts.netloc: raise ValueError("A public HTTP(S) URL is required") if parts.username or parts.password or not re.fullmatch(r"[A-Za-z0-9.-]+(?::\d+)?", parts.netloc): raise ValueError("URL credentials or invalid host names are not allowed") return value ``` The accepted destination is then sent to the remote fetch service: ```python def unlock(url: str, token: str, geography: str = "us", clean_content: bool = True, timeout: float = 120) -> dict[str, Any]: payload = { "url": normalize_url(url), "type": "html", "js_render": "True", "clean_content": "true" if clean_content else "false", "country": geography.lower(), "follow_redirect": "True", "isjson": "1", } return _post(UNLOCKER_ENDPOINT, token, json.dumps(payload).encode("utf-8"), "application/json", timeout) ``` The primary SEO workflow relies on that syntactic validation: ```python base = normalize_url(args.url) if not 1 <= args.max_pages <= 50: raise ValueError("--max-pages must be between 1 and 50") origin = "{}://{}".format(urlsplit(base).scheme, urlsplit(base).netloc) plan = {"url": base, "max_pages": args.max_pages, "robots": urljoin(origin, "/robots.txt"), "sitemap": urljoin(origin, "/sitemap.xml")} args.output_dir.mkdir(parents=True, exist_ok=True) write(args.output_dir / "plan.json", plan) if args.dry_run: print(json.dumps(plan, ensure_ascii=False, indent=2)) return 0 token = ...[truncated 3261 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/catalog_builder.py:68

Finding

Catalog Preview Generates Shell Commands Without Escaping User-Controlled Values

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (27)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Polling Dataify task-status/download endpoints with an API token and downloading arbitrary scraper results is substantially broader than analyzing onsite SEO signals. If the downloaded artifacts are generic scraper outputs rather than fixed audit evidence, the skill can become a thin wrapper around authenticated remote data extraction.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Polling Dataify task-status/download endpoints with an API token and downloading arbitrary scraper results is substantially broader than analyzing onsite SEO signals. If the downloaded artifacts are generic scraper outputs rather than fixed audit evidence, the skill can become a thin wrapper around authenticated remote data extraction.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Polling Dataify task-status/download endpoints with an API token and downloading arbitrary scraper results is substantially broader than analyzing onsite SEO signals. If the downloaded artifacts are generic scraper outputs rather than fixed audit evidence, the skill can become a thin wrapper around authenticated remote data extraction.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Polling Dataify task-status/download endpoints with an API token and downloading arbitrary scraper results is substantially broader than analyzing onsite SEO signals. If the downloaded artifacts are generic scraper outputs rather than fixed audit evidence, the skill can become a thin wrapper around authenticated remote data extraction.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Polling Dataify task-status/download endpoints with an API token and downloading arbitrary scraper results is substantially broader than analyzing onsite SEO signals. If the downloaded artifacts are generic scraper outputs rather than fixed audit evidence, the skill can become a thin wrapper around authenticated remote data extraction.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Polling Dataify task-status/download endpoints with an API token and downloading arbitrary scraper results is substantially broader than analyzing onsite SEO signals. If the downloaded artifacts are generic scraper outputs rather than fixed audit evidence, the skill can become a thin wrapper around authenticated remote data extraction.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Polling Dataify task-status/download endpoints with an API token and downloading arbitrary scraper results is substantially broader than analyzing onsite SEO signals. If the downloaded artifacts are generic scraper outputs rather than fixed audit evidence, the skill can become a thin wrapper around authenticated remote data extraction.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md

2. Run `scripts/run_seo_audit.py`; start with dry-run when scope is uncertain.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

2. Run `scripts/run_seo_audit.py`; start with dry-run when scope is uncertain.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file implements business-intelligence workflows (price, review, lead, brand) that materially differ from the declared SEO-audit skill purpose. This scope mismatch is dangerous because users may authorize or supply data expecting webpage SEO analysis while the skill performs unrelated competitive intelligence and monitoring actions, violating least surprise and potentially organizational policy boundaries.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The action builder dispatches to shopping, review, news, LinkedIn, Crunchbase, and brand-monitoring collection capabilities that are unrelated to auditing crawlability, indexing, metadata, canonicals, headings, or structured data. In the context of an SEO-audit skill, this expands data collection into off-purpose surveillance and profiling behavior, increasing privacy, compliance, and misuse risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The lead-intelligence path targets LinkedIn and Crunchbase company entities and scores prospects, which is unrelated to a public webpage SEO audit. That makes the skill capable of company targeting and enrichment under misleading packaging, creating elevated risk of unauthorized prospecting, profiling, or policy evasion.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest says the skill is for technical or on-page SEO diagnosis and specifically says not to use it for keyword-only SERP lookup. However, the search function posts arbitrary queries to a SERP endpoint with engine: google, enabling exactly the excluded keyword-search behavior rather than webpage/website auditing.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script performs live search queries, including arbitrary user-supplied keywords, via the external search() call despite the skill description explicitly prohibiting keyword-only SERP lookup. This creates a scope-control violation: users may believe the tool only performs technical SEO audits, while it also transmits search terms to an external provider and returns ranking data, which can bypass policy or product restrictions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence

Finding

The skill declares capabilities that imply shell, network, file, and environment access but does not explicitly constrain them with an allowlist or permissions block. In a skill that invokes external scripts and authenticated APIs, missing tool scoping increases the chance of unintended tool use, broader-than-expected data access, or abuse if the implementation is swapped or extended.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md

## Account CTA policy

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
- For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management.
- During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring explicitly says this is shared code for 'Dataify business skills,' contradicting the declared SEO-audit identity. This inconsistency is a strong indicator of repurposed or mislabeled functionality, which is dangerous because it undermines trust boundaries and suggests the code may execute actions outside what users and reviewers expect.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script includes price intelligence and review scraping flows that exceed the stated SEO-audit purpose. While not inherently malicious, embedding such collection in an SEO tool can mislead users and quietly broaden external data gathering into competitor analysis and review harvesting without appropriate justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The direct_request path sends user-supplied queries and URLs to external Dataify endpoints, but this code path contains no explicit notice, consent, or minimization controls beyond requiring an API token. In a mislabeled SEO-audit skill, that undisclosed transmission is more concerning because users may not expect their inputs to be repurposed for third-party business-intelligence collection services.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/business_workflow.py (reported line 180)May include surrounding context.

python

def execute_action(action: dict[str, Any], token: str) -> subprocess.CompletedProcess[str]:
    invocation = command(action)
    if len(invocation) > 1 and Path(invocation[1]).exists():
        return subprocess.run(invocation, capture_output=True, text=True, encoding="utf-8", errors="replace", check=False)
    if action.get('capability', '').startswith('scraper-'):
        return subprocess.CompletedProcess([], 1, '', 'Required platform scraper is not installed; install it before executing this action.')
    return direct_request(action, token)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/catalog_builder.py (reported line 70)May include surrounding context.

python

def build_curl(tool, spider_parameters_json):
    return " \\\n".join([
        "curl -X POST '{}'".format(BUILDER_URL),
        "  -H 'Authorization: Bearer $DATAIFY_API_TOKEN'",
        "  -H 'Content-Type: application/x-www-form-urlencoded'",
        "  -d 'spider_name={}'".format(tool["spider_name"]),

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This client sends user-supplied search queries and target URLs to third-party Dataify endpoints, which can expose potentially sensitive research terms, internal project names, or private URLs entered by a user. In an SEO-audit context this is somewhat expected, but the absence of explicit disclosure, consent, or guardrails increases the risk of unintended data sharing to an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script makes live requests to target sites and external services (unlock and search) without an explicit warning that URLs, page contents, and optional keywords will be transmitted off-host. In a security/privacy context, undisclosed network transmission can expose sensitive targets, internal assessment interests, or proprietary keywords to third parties and can surprise users who expect offline analysis.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script stores full fetched HTML pages and generated reports under the output directory without prominently warning the user that third-party site content will be retained locally. This can create data handling and compliance risks, especially if audited pages contain personal data, unpublished content exposed to the crawler, or licensed material that operators did not expect to persist on disk.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/task_runtime.py:38