Dataify Tiktok Builder

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:00 AM UTC
• Version: 1.3.1

Overview

This skill is presented as a TikTok comment collector, but its artifacts enable broader TikTok profile/shop/post collection and include risky helper code around credentials and task execution.

Install only after the publisher narrows the catalog to the declared comment-by-URL task, removes or clearly separates unrelated business-intelligence helpers, fixes credential handling, and avoids persistent plaintext token setup. Treat generated curl commands and task IDs as sensitive, and require explicit confirmation before Dataify submissions that may spend credits or collect profile-level data.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/wait_for_task.py:35

Finding

API Credential Exposed in HTTP Query Strings

Content

View full analysis

") ``` Authentication through an `Authorization` header is already used elsewhere in the project and is a less exposed transport mechanism. Query-string authentication therefore exceeds the minimum credential exposure necessary for the operation. ### Attack Path 1. A user configures `DATAIFY_API_TOKEN` and submits a normal Dataify task. 2. `wait_for_task()` calls `request_json()` to poll task status. 3. The function constructs a URL such as: `https://scraperapi.dataify.com/task_status?ap ...[truncated 678 chars]

Remediation

View remediation

`, consistent with the other Dataify clients in the project. - Prefer POST requests for operations that cannot safely be represented without sensitive parameters in a URL. - If the upstream API only supports query-string credentials, request a safer authentication contract from the service provider. - Until the API is changed, use short-lived, narrowly scoped credentials and configure strict URL-query redaction in proxies, servers, logging systems, and telemetry. - Add automated tests asserting that generated request URLs never contain `DATAIFY_API_TOKEN`. - Rotate any credentials that may already have appeared in request logs. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/catalog_builder.py:88

Finding

Shell Command Injection Through Generated Curl Commands

Content

View full analysis

Remediation

View remediation

T07 · Tool Hijacking and Spoofing

Error

• Location: scripts/build-dataify-request.py:5

Finding

Adjacent Module Path Precedence Enables Python Module Hijacking

Content

View full analysis

Remediation

View remediation

other

Warning

• Location: SKILL.md:1

Finding

Declared Comment-Only Scope Contradicts Broader Profile, Shop, and Post Collection

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:36

Finding

Plaintext API Token Persistence Recommended in Shell Startup Files

Content

View full analysis

> ~/.bashrc source ~/.bashrc ``` ```bash echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.zshrc source ~/.zshrc ``` ### Technical Analysis The setup instructions prioritize persistent storage of an API token. On macOS and Linux, the token is written in plaintext to shell startup files. On Windows, it is stored as a user environment variable, which is also not a protected secret-storage mechanism. Shell startup files and environment-variable configuration are frequently copied into backups, support bundles, dotfile repositories, diagnostic output, or process environments. Other processes running as the same user may also be able to read inherited environment variables. The later account policy recommends showing session-scoped setup first, but the dedicated setup section explicitly prefers permanent storage. This inconsistency can lead users to adopt the less secure option. ### Attack Path 1. A user follows the documented setup instructions. 2. The live API token is stored in a shell startup file or persistent user environment variable. 3. The file or environment configuration is copied to a backup, committed to a dotfile repository, included in diagnostics, or read by another process running under the account. 4. An actor obtains the token. 5. The actor reuses it for Dataify API operations until it is rotated or revoked. ### Impact Assessment Credential disclosure may allow unauthorized collection tasks, access to task results, and consumption of accou ...[truncated 193 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/business_workflow.py:584

Finding

Unvalidated Resume State Enables Output Path Traversal

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (37)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The skill is capable of monitoring and downloading final JSON output for Dataify tasks by task ID, which is broader than collecting comments from one known TikTok URL. This can enable access to results from other scraper tasks if a task ID is supplied, extending the skill beyond its declared trust and data boundaries.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is capable of monitoring and downloading final JSON output for Dataify tasks by task ID, which is broader than collecting comments from one known TikTok URL. This can enable access to results from other scraper tasks if a task ID is supplied, extending the skill beyond its declared trust and data boundaries.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is capable of monitoring and downloading final JSON output for Dataify tasks by task ID, which is broader than collecting comments from one known TikTok URL. This can enable access to results from other scraper tasks if a task ID is supplied, extending the skill beyond its declared trust and data boundaries.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill is capable of monitoring and downloading final JSON output for Dataify tasks by task ID, which is broader than collecting comments from one known TikTok URL. This can enable access to results from other scraper tasks if a task ID is supplied, extending the skill beyond its declared trust and data boundaries.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is capable of monitoring and downloading final JSON output for Dataify tasks by task ID, which is broader than collecting comments from one known TikTok URL. This can enable access to results from other scraper tasks if a task ID is supplied, extending the skill beyond its declared trust and data boundaries.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is capable of monitoring and downloading final JSON output for Dataify tasks by task ID, which is broader than collecting comments from one known TikTok URL. This can enable access to results from other scraper tasks if a task ID is supplied, extending the skill beyond its declared trust and data boundaries.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is capable of monitoring and downloading final JSON output for Dataify tasks by task ID, which is broader than collecting comments from one known TikTok URL. This can enable access to results from other scraper tasks if a task ID is supplied, extending the skill beyond its declared trust and data boundaries.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill explicitly instructs users to choose among multiple TikTok scraper tools, including shop, posts, and profiles, despite claiming to only collect comments by URL. This is a direct scope expansion that could be used to evade restrictions on profile collection or general discovery.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill metadata says it is limited to TikTok comments by URL, but the body instructs the agent to offer multiple unrelated TikTok scrapers including shop, posts, and profiles. This broadens data collection scope beyond the declared purpose and can cause the agent to perform over-collection or use the wrong tool, increasing privacy, policy, and abuse risk.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

量，而不是只在当前终端临时设置。

Windows PowerShell，当前用户永久设置：

powershell

[Environment]::SetEnvironmentVariable("DATAIFY_API_TOKEN", "your_token_here", "User")

然后重新打开 PowerShell。如果当前会话也要立即生效，再执行：

powershell

$env:DATAIFY_API_TOKEN = "your_token_here"

macOS 或 Linux，bash 永久设置：

bash

echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.bashrc
source ~/.bashrc

macOS 或 Linux，zsh 永久设置：

bash

echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.zshrc
source ~/.zshrc

脚本用法

Python：

bash

python scripts/build-dataify-request.py --tool-sign <selected_tool_sign> --values-file values.json

PowerShell：

powershell

& ".\scripts\build-dataify-request.ps1" -ToolSign "<selected_tool_sign>" -ValuesFile ".\values.json"

values.json 可以是单个对象，也可以是对象数组。

输出格式

最终 curl 命令应为

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 50)May include surrounding context.

量，而不是只在当前终端临时设置。

Windows PowerShell，当前用户永久设置：

powershell

[Environment]::SetEnvironmentVariable("DATAIFY_API_TOKEN", "your_token_here", "User")

然后重新打开 PowerShell。如果当前会话也要立即生效，再执行：

powershell

$env:DATAIFY_API_TOKEN = "your_token_here"

macOS 或 Linux，bash 永久设置：

bash

echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.bashrc
source ~/.bashrc

macOS 或 Linux，zsh 永久设置：

bash

echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.zshrc
source ~/.zshrc

脚本用法

Python：

bash

python scripts/build-dataify-request.py --tool-sign <selected_tool_sign> --values-file values.json

PowerShell：

powershell

& ".\scripts\build-dataify-request.ps1" -ToolSign "<selected_tool_sign>" -ValuesFile ".\values.json"

values.json 可以是单个对象，也可以是对象数组。

输出格式

最终 curl 命令应为

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill is described as collecting TikTok comments from a known content URL, but the parameter file exposes additional tools for shop lookup, post listing, profile lookup, and profile search. This creates a scope mismatch that can enable broader data collection and user discovery than the declared purpose, increasing the risk of unauthorized scraping, privacy overreach, and misuse of the skill under a narrower trust assumption.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Including profile and post-discovery inputs in a skill meant only for comments from a known URL expands the capability from targeted retrieval to account discovery and broader enumeration. In this context, that makes the skill more dangerous because the published description explicitly tells users not to use it for profile collection or general TikTok discovery, yet the configuration still enables exactly those actions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This file implements a generic business-intelligence orchestration framework covering pricing, reviews, leads, and brand monitoring, which is far outside the declared scope of a TikTok comment-by-URL skill. In this context, the overbroad capability materially increases the chance of unauthorized collection, scope bypass, and misuse of the installed skill as a general reconnaissance/scraping tool.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code routes URLs to generic web unlocking and unrelated third-party scrapers such as Amazon comments and Google Maps reviews, none of which are justified by a TikTok comment-by-URL skill. This makes the skill effectively a multi-target scraping launcher, which is especially dangerous because the declared skill context would cause users or reviewers to underestimate its true collection scope.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The action builder creates Google, shopping, news, LinkedIn, and Crunchbase discovery searches for business intelligence use cases unrelated to TikTok comments. In a skill advertised as collecting comments from a known TikTok URL, these discovery functions create a clear scope mismatch and enable broader data gathering than the user and platform description imply.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill declares broad operational behavior involving environment access, file reads, network use, and shell-oriented command construction, but provides no explicit permission or allowed-tools boundary. That omission weakens governance and makes it easier for a narrowly described skill to exercise broader capabilities than a reviewer or user would expect.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The workflow says to ask the user to choose from a Chinese list, which imposes a specific language on the interaction. There is no accompanying opt-in, language choice, or justification that the skill is limited to Chinese-speaking users.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

The skill instructs transmission of user-supplied and task parameters to an external service endpoint. External transmission is expected for a scraper integration, but it is still security-relevant because the skill does not emphasize data minimization, approved destinations, or constraints ensuring only intended TikTok-comment data is sent.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md

13. Set `spider_name` to `tiktok.com`.
14. Set `spider_id` to the selected tool's `tool_sign`.
15. Always include `spider_errors=true` and `file_name={{TasksID}}`.
16. Return a curl command for `https://scraperapi.dataify.com/builder`.

## Set DATAIFY_API_TOKEN

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The default completion behavior goes beyond building a request and instructs the agent to submit, monitor, and download results automatically. That increases risk by turning a formatting helper into an autonomous remote-execution workflow with potential cost, privacy, and scope consequences.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

The skill instructs autonomous continuation of the original task after token verification, reducing opportunities for the user to review cost-bearing or scope-sensitive actions. In a workflow that can submit remote scraping jobs, this increases the chance of unintended execution.

Content

Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.

md

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
- For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management.
- During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

The skill explicitly instructs generation of a curl request that sends user-supplied scraping parameters and an authorization token to scraperapi.dataify.com. External transmission is expected for this integration, but it still represents data exfiltration to a third party and can expose user-provided targets or collected content if scope controls are weak.

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 3)May include surrounding context.

md

---
name: "dataify-tiktok-comment-by-url"
description: "为 tiktok.com 上以 tiktok_comment_by-url 为根的 scraper 系列准备 Dataify builder 请求。当需要处理成功的 Dataify scraper detail 条目 tiktok_comment_by-url、让用户选择可用工具、读取已保存的 getToolParams 选项，并使用 DATAIFY_API_TOKEN 生成 scraperapi.dataify.com/builder curl 请求时，使用此 skill。"
---

# Dataify Builder Skill 中文版

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The front-matter description presents a comment-by-URL skill, but the description text immediately reframes it as a generic builder for a scraper family rooted at that tool. That mismatch weakens operator understanding and security review assumptions, making it easier for the skill to be invoked for broader collection than intended.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

md

## Account CTA policy

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 113)May include surrounding context.

md

## Account CTA policy

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/task_runtime.py:38