Security audit
Security checks for vulnerabilities and agentic risk
The main skill is a Dataify task monitor, but the package also contains broader undeclared scraping and business-intelligence scripts plus risky token handling that users should review before installing.
Install only if you are comfortable with a Dataify integration that can use your API token and contact Dataify services. Before trusting it broadly, the publisher should either remove or clearly disclose the extra business-intelligence/search/unlock scripts, and should avoid putting DATAIFY_API_TOKEN in request URLs. Use a limited/rotatable Dataify token and avoid running preview/generated commands from untrusted parameter files.
scripts/wait_for_task.py:34API Credential Exposed in HTTP Query Strings
scripts/catalog_builder.py:88Shell Command Injection in Generated Curl Preview
The declared description is about monitoring an already-submitted Dataify Builder task, resuming after interruption, or helping configure the API token. The code instead implements a standalone workflow engine that creates actions from user inputs, executes searches/scrapes against Dataify and related capabilities, optionally resumes local state, discovers additional detail URLs, parses collected payloads into structured records, analyzes them, and produces final reports. While it does support local resume from a saved state and does check whether DATAIFY_API_TOKEN is present, those are secondary implementation details. The primary behavior is data collection and business-intelligence report generation, not task monitoring or token-setup guidance. This is a material description-behavior mismatch.
The declared purpose centers on monitoring Dataify Builder tasks through completion, recovering after interruption, and guiding token setup. While the code does include token handling and the token error message aligns partially with setup guidance, its primary behavior is materially different: it directly calls Dataify scraping/search endpoints (scraperapi.dataify.com/request and webunlocker.dataify.com/request) to execute searches and fetch/unlock web pages. There is no task-status polling, no task ID handling, no resume/recovery workflow, and no Builder task orchestration. This is not merely a supporting implementation detail for monitoring; it is a separate operational capability for submitting/performing scraping requests. Therefore the description does not accurately represent the code chunk.
The implemented script is limited to token setup guidance and environment inspection. That partially matches the token-configuration portion of the description, but it does not implement the broader and primary claimed capabilities around monitoring Dataify Builder tasks, recovering after interruption, or acting on existing task IDs. Because significant declared functionality is absent and the actual behavior is substantially narrower than the declared purpose, this is a description-behavior mismatch.
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
ershell $env:DATAIFY_API_TOKEN = "YOUR_TOKEN" if ($env:DATAIFY_API_TOKEN) { "configured" } else { "missing" }
Windows Command Prompt:
```cmd
set DATAIFY_API_TOKEN=YOUR_TOKEN
if defined DATAIFY_API_TOKEN (echo configured) else (echo missing)
macOS zsh:
echo 'export DATAIFY_API_TOKEN="YOUR_TOKEN"' >> ~/.zshrc
source ~/.zshrc
Linux bash:
echo 'export DATAIFY_API_TOKEN="YOUR_TOKEN"' >> ~/.bashrc
source ~/.bashrc
Windows PowerShell user environment:
[Environment]::SetEnvironmentVariable("DATAIFY_API_TOKEN", "YOUR_TOKEN", "User")
Windows Command Prompt user environment:
setx DATAIFY_API_TOKEN "YOUR_TOKEN"
Persistent changes affect new processes. Tell the user to open a new terminal or restart the agent application when the active process cannot see the updated value.
.envRecommend a project .env only when the actual command explicitly loads it. Creating the file alone does n
This file implements broad market-intelligence collection, scraping orchestration, and report generation across pricing, reviews, leads, and brand monitoring, which materially exceeds the manifest's stated purpose of task monitoring/interruption recovery/token setup. That hidden expansion of capability is dangerous because a user or host system may invoke the skill under a narrow trust model while the code performs unrelated external data collection and analysis.
The code can autonomously build and execute multiple search and scraping actions, including direct requests to external Dataify endpoints and local scraper scripts, despite the skill being described as task monitoring/token guidance. This mismatch increases risk because the skill can be used as an undeclared data-collection engine, causing unauthorized external requests and broader data exposure than users expect.
The skill instructs use of environment variables, shell scripts, repository files, and networked task/result retrieval, but it declares no explicit tool scope or permissions boundary. That makes the effective capability set broader and less auditable, increasing the risk that an agent executes shell/network/file operations beyond what reviewers or policy expect.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
2. Read `DATAIFY_API_TOKEN` from the environment. Never accept or print it as a command-line argument. If it is missing, follow [Token setup](references/token-setup.md), show only the current platform's setup command, and resume this workflow after safe verification.
3. Use an installed Dataify task-status/result tool when available. Do not invent an endpoint that is not documented in the repository or exposed by a connected tool.
4. After a scraper submission, monitor by default with `scripts/wait_for_task.py`. Stop at submission only when the user explicitly asks for a task ID or `--no-wait` behavior.
5. If status is queued or running, continue bounded monitoring. Do not ask the user to request monitoring separately.
6. If succeeded, download and return the available result. Summarize large results and preserve access to raw data.
7. If failed, return the provider error, likely corrective action, and whether retrying is safe.
8. If monitoring times out or is interrupted, report the task ID and exact resume command. Never resubmit merely because monitoring stopped.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
## Safety
- Do not retry paid or high-volume tasks without confirmation.
- Do not expose tokens, cookies, signed URLs, or private result contents in logs.
- Do not infer success from the presence of a task ID.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
## Account CTA policy
- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
- For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management.
- During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.
The skill enables implicit invocation with no visible activation constraints, so the agent may call this skill automatically in situations the user did not clearly intend. Because this skill can monitor existing Dataify tasks and return their results, overly broad triggering can cause unintended access to task outputs or execution in contexts where submission-only behavior was expected.
User-provided queries, subjects, geography, and URLs are transmitted to external Dataify endpoints without an in-context warning or consent checkpoint at the request site. In a skill presented as monitoring/token setup, this is especially risky because users may not realize their inputs are being forwarded off-box to third-party services for scraping and search.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def execute_action(action: dict[str, Any], token: str) -> subprocess.CompletedProcess[str]:
invocation = command(action)
if len(invocation) > 1 and Path(invocation[1]).exists():
return subprocess.run(invocation, capture_output=True, text=True, encoding="utf-8", errors="replace", check=False)
if action.get('capability', '').startswith('scraper-'):
return subprocess.CompletedProcess([], 1, '', 'Required platform scraper is not installed; install it before executing this action.')
return direct_request(action, token)
The file performs autonomous extraction, filtering, scoring, and synthesis of lead, pricing, review, and brand intelligence, including qualification scores and acceptance gates, which are unrelated to the stated monitoring purpose. While not necessarily exploit code, this is a security-relevant overreach because it enables undeclared profiling and decision-support behavior under the cover of a narrower skill description.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
def build_curl(tool, spider_parameters_json):
return " \\\n".join([
"curl -X POST '{}'".format(BUILDER_URL),
" -H 'Authorization: Bearer $DATAIFY_API_TOKEN'",
" -H 'Content-Type: application/x-www-form-urlencoded'",
" -d 'spider_name={}'".format(tool["spider_name"]),
The file exposes broad-purpose search() and unlock() network primitives that can perform arbitrary web search and fetch/render public webpages, which exceeds the stated skill scope of task monitoring, recovery, and token setup. In an agent skill, this kind of capability expansion is dangerous because it enables unintended external data access and browsing behavior, increasing the chance of policy bypass, data exfiltration workflows, or misuse as a general reconnaissance/fetching tool.