dataify-task-status

• Outcome: Review
• Latest audit: Jul 24, 2026 · 11:04 AM UTC
• Version: 1.0.0

Overview

This skill is mostly coherent, but a status check can automatically download and print the task’s full JSON result without a separate user confirmation.

Review before installing if Dataify task results may contain sensitive or large scraped data. The skill uses DATAIFY_API_TOKEN, contacts Dataify, and may print full task output when a task succeeds; use it only where that behavior is acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill instructs use of an environment-sourced API token and outbound network access, but it does not declare those capabilities or permissions. That creates a transparency and governance gap: operators may approve a seemingly low-risk status-check skill without realizing it can access secrets and make authenticated external requests.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The stated purpose is to check task status, but the workflow also fetches task output from a separate `/download` endpoint when the task succeeds. This is more dangerous in context because downloaded results may contain scraped content or sensitive data, so a user or reviewer expecting metadata-only status checks could unintentionally authorize content retrieval and disclosure.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill is presented as a task-status checker, but its workflow expands behavior on success to automatically call a download endpoint and retrieve task output. That creates a scope mismatch: a user or calling agent expecting a metadata-only status check may inadvertently trigger extra network activity and expose or ingest result data without explicit consent.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The skill is described as checking task execution status, but it includes logic to construct a download endpoint for full task results. This expands the skill from metadata/status inspection into data retrieval, which can expose scraped content unexpectedly and violate least-privilege expectations for users invoking a status-only tool.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: When the status indicates success, the script automatically performs a second network call and prints the full task output. In a status-checking context, this is dangerous because it can silently disclose potentially large or sensitive scraped data to the caller or downstream logs even when the user only asked whether the task completed.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The markdown specifies an automatic follow-up download when status is successful, but does not require a user-facing warning or confirmation before retrieving potentially sensitive task results. In an agent setting, this can cause unanticipated data access, increased data exposure, and behavior that exceeds the principle of least surprise for a status-only operation.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.