Dataify Task Status

• Outcome: Review
• Latest audit: Sep 1, 2026 · 9:26 AM UTC
• Version: 1.3.0

Overview

This skill is advertised as a task-status checker but automatically downloads and prints completed task results when a task succeeds.

Review before installing. The skill is not just a status checker: if a task is successful, it will fetch and print the completed JSON output using your Dataify API token. Install only if you are comfortable with automatic result retrieval, or ask the publisher to split status checking and result downloading into separate explicit actions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill performs environment-variable access and network calls but does not declare those capabilities. Hidden capability use reduces reviewability and can mislead operators about what the skill is allowed to do, especially because it accesses a credential and reaches an external API. In this context, the omission is more concerning because the skill also understates its effective behavior elsewhere.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The manifest says the skill only checks task state and must not download completed results, but the documented workflow says that on success it immediately calls GET /download and prints the JSON result. That mismatch can cause users or policy systems to approve a low-risk status check while the skill actually retrieves potentially sensitive scraped data. The context makes this more dangerous because a successful task may contain harvested third-party content or PII.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The inline documentation expands the skill from a status checker into a result downloader by instructing a follow-up download when status is successful. This broadens the data-access scope beyond the advertised purpose and can expose downloaded scraper output without the user clearly consenting to that additional action. In a data-scraping context, that output may be sensitive, copyrighted, or unexpectedly large.

Intent-Code Divergence

High

• Confidence: 96% confidence
• Finding: This line directly contradicts the manifest by instructing the skill to download results after a successful status response. Contradictory documentation undermines trust boundaries and may bypass user expectations, allowing data retrieval under the guise of a read-only status check. The contradiction is particularly risky because it combines external network access with immediate output of retrieved content.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill claims to only check task status, but on a successful status it automatically performs a separate `GET /download` request and outputs the completed result. This expands the skill from read-only status inspection into data retrieval, which can expose scraped content unexpectedly, violate least-privilege expectations, and cause users or calling systems to trigger a more sensitive action than requested.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The documentation explicitly states that a status-checking script will automatically call `/download` with the same `api_key` and `task_id` when a task succeeds. This exceeds the stated skill purpose of status-only checking, creates an undisclosed secondary network action, and can cause unauthorized data retrieval or secret-bearing requests without clear user intent.

Intent-Code Divergence

High

• Confidence: 96% confidence
• Finding: The inline documentation contradicts the skill metadata by claiming result retrieval is built into the status script, despite the skill being described as not downloading completed results. This kind of capability mismatch is dangerous because reviewers and users may authorize a narrow status check while the implementation performs broader data-access operations.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The skill metadata explicitly says it should only check task status and must not download completed results, but the code downloads and prints task output whenever the status equals success. That creates an unauthorized data-access path and can expose potentially sensitive scraped content beyond the declared scope of the skill.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The documentation claims the script only queries task status, but the implementation also retrieves full task output on success. This mismatch is security-relevant because operators and policy systems may grant the skill access based on a narrower understanding of its behavior.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The markdown describes an automatic follow-up request to download results using the same API key and task ID, but does not present this as a user-visible warning or consent boundary. Hidden chained requests increase the risk of over-collection, surprise data access, and unintended secret propagation to an additional endpoint.

Static analysis

No suspicious patterns detected.