ClawHub
Back to skill

Security audit

Dataify X Builder

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly performs Dataify scraping work, but it exposes broader collection modes and credential-handling risks than its profile-URL-only description suggests.

Review before installing. Use a limited Dataify token, avoid permanent shell-profile token storage, and do not use this package unless you are comfortable with the broader X collection options, bundled business-intelligence code, and generic task-result polling beyond the named profile-URL workflow.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)

T07 · Tool Hijacking and Spoofing

Error
Location
scripts/build-dataify-request.py:5
Finding

External Module Shadowing Can Execute Unreviewed Code

Content
View full analysis

Vulnerability Details

File Location: scripts/build-dataify-request.py:5-9
Vulnerability Type: Python module search-path hijacking
Risk Level: High

Vulnerable Code

python
TASK_RUNTIME_DIR = os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "dataify-task-operations", "scripts"))
if TASK_RUNTIME_DIR not in sys.path:
    sys.path.insert(0, TASK_RUNTIME_DIR)

from catalog_builder import build_curl, run_catalog_builder

Technical Analysis

The launcher inserts an external sibling directory at the beginning of sys.path before importing catalog_builder. Because index zero has the highest import priority, a catalog_builder.py placed in that external directory supersedes the reviewed implementation bundled in this project.

Python executes module-level code during import. Consequently, an attacker who can create or modify the external module can execute arbitrary code as soon as the documented launcher is run. The substituted module also receives access to the current process environment, which may contain DATAIFY_API_TOKEN.

This is a local tool-hijacking condition rather than remote payload retrieval: the effective implementation can be replaced outside the audited project without modifying the launcher itself.

Attack Path

  1. An attacker gains write access to the expected sibling path dataify-task-operations/scripts.
  2. The attacker creates or replaces catalog_builder.py with malicious module-level code.
  3. A user runs the documented scripts/build-dataify-request.py helper.
  4. The launcher prepends the attacker-controlled directory to sys.path.
  5. Python imports and executes the substituted module.
  6. The malicious module can read environment variables, access files available to the process, make network requests, or spoof task results.

Impact Assessment

Successful exploitation provides arbitrary code execution with the same operating-system priv ...[truncated 292 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the external sys.path modification and import the bundled implementation through an explicit package-relative import.
  • Avoid ambiguous top-level module names that can be shadowed by adjacent directories.
  • If an external runtime is genuinely required, resolve a fixed trusted path and verify its version and cryptographic digest before loading it.
  • Package the shared runtime as a pinned dependency rather than dynamically preferring an uncontrolled local directory.
  • Run task submission with a narrowly scoped API token and an execution account with minimal filesystem permissions.
  • Add a regression test proving that a sibling catalog_builder.py cannot replace the bundled implementation.

T09 · Insecure Skill Coding Practices

Error
Location
scripts/wait_for_task.py:34
Finding

API Token Is Transmitted in URL Query Parameters

Content
View full analysis

Vulnerability Details

File Location: scripts/wait_for_task.py:34-39, 103-108, 122-127
Vulnerability Type: Sensitive credential exposure through request URLs
Risk Level: High

Vulnerable Code

python
def request_json(endpoint, params, api_key, timeout):
    url = endpoint + "?" + urllib.parse.urlencode(params)
    request = urllib.request.Request(url, method="GET")
    try:
        with urllib.request.urlopen(request, timeout=timeout) as response:
            content = response.read()

The function is called with the API token inside params:

python
payload = request_json(
    STATUS_ENDPOINT,
    {"api_key": api_key, "task_id": task_id},
    api_key,
    request_timeout,
)

The same behavior is used for result downloads:

python
return request_json(
    DOWNLOAD_ENDPOINT,
    {"api_key": api_key, "task_id": task_id, "type": "json"},
    api_key,
    request_timeout,
)

Technical Analysis

The Dataify API token is encoded directly into the URL query string for both status polling and result download requests. HTTPS encrypts the URL while it is in transit, but the destination service necessarily receives the full URL. URLs are also commonly retained by access logs, reverse proxies, observability products, debugging tools, and error telemetry.

The response-body replacement performed later by the function only redacts the token if the server echoes it in the response. It does not remove the token from the outgoing URL or from infrastructure logs.

Attack Path

  1. A user configures DATAIFY_API_TOKEN and submits or resumes a task.
  2. wait_for_task appends the token to every polling and download URL.
  3. A server, proxy, monitoring component, or debugging facility records the request URL.
  4. A party with access to those logs extracts the api_key parameter.
  5. The exposed credential is used to access task data or issue unauthorized requ ...[truncated 386 chars]
Remediation
View remediation

Remediation Suggestions

  • Send the token in an Authorization: Bearer request header instead of the query string.
  • Keep only non-sensitive values such as the task identifier and response type in the URL.
  • Prefer a POST body if the remote API cannot accept an authorization header.
  • Ensure application, proxy, and access logs redact legacy api_key parameters.
  • Rotate tokens that may already have appeared in logs.
  • Add automated tests that reject any outgoing URL containing api_key, the raw token, or equivalent credential parameters.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:44
Finding

Documentation Recommends Persistent Plaintext API Token Storage

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:44-67
Vulnerability Type: Plaintext credential persistence
Risk Level: Medium

Vulnerable Code

markdown
## Set DATAIFY_API_TOKEN

Prefer a permanent environment-variable setup instead of setting the token only for the current terminal session.

Windows PowerShell, permanent for the current user:
```powershell
[Environment]::SetEnvironmentVariable("DATAIFY_API_TOKEN", "your_token_here", "User")

macOS or Linux, permanent for bash:

bash
echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.bashrc
source ~/.bashrc

macOS or Linux, permanent for zsh:

bash
echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.zshrc
source ~/.zshrc
text

Equivalent persistent setup guidance also appears in `SKILL.zh-CN.md:29-56`.

### Technical Analysis

The instructions explicitly prefer permanent credential configuration and direct users to write the raw token into shell startup files or a persistent user environment variable. Shell initialization files are plaintext configuration files and are frequently included in backups, troubleshooting archives, home-directory synchronization, or dotfile repositories.

This behavior is not system persistence in the backdoor sense represented by T06. It is an insecure secret-storage practice because session-scoped configuration is sufficient for the Skill’s operation.

### Attack Path

1. A user follows the recommended persistent setup command.
2. The raw token is stored in a shell startup file or persistent user environment.
3. Another local process, user with appropriate access, backup operator, support bundle, or accidentally published dotfile obtains the stored value.
4. The recovered token is used for unauthorized Dataify operations.

### Impact Assessment

The exposed credential may permit unauthorized task submissions, credit consumption, and access to Dataify task results. The expo
...[truncated 87 chars]
Remediation
View remediation

Remediation Suggestions

  • Make session-scoped environment configuration the default.
  • Recommend an operating-system credential manager or managed secret store for persistent use.
  • Do not place raw tokens in .bashrc, .zshrc, project files, or version-controlled dotfiles.
  • If file-based storage is unavoidable, use a dedicated file with restrictive permissions and load it only for the required process.
  • Document token rotation and revocation procedures.
  • Update both English and Chinese documentation consistently.

other

Warning
Location
SKILL.md:1
Finding

Executable Tool Scope Exceeds the Declared Profile-URL-Only Function

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:1-3, 20-27
Vulnerability Type: Undeclared functional scope expansion
Risk Level: Medium

Vulnerable Code

The declared scope states:

markdown
---
name: "dataify-twitter-profile-by-profileurl"
description: "Collect an X/Twitter profile from a known profile URL. Do not use for posts, keyword search, or arbitrary X URLs."
---

The workflow nevertheless directs the Agent to offer broader tools:

markdown
3. Ask the user to choose exactly one tool from the following Chinese list:
- 通过个人资料 URL采集 (twitter_profile_by-profileurl)
- 通过Twitter 用户名采集 (twitter_profile_by-username)
- 通过个人资料URL采集 (twitter_post_by-profileurl)

The executable catalog enables all three:

json
[{"tool_name_cn":"个人资料URL","tool_sign":"twitter_profile_by-profileurl","spider_name":"x.com","params":[]},{"tool_name_cn":"用户名","tool_sign":"twitter_profile_by-username","spider_name":"x.com","params":[]},{"tool_name_cn":"帖子资料URL","tool_sign":"twitter_post_by-profileurl","spider_name":"x.com","params":[]}]

Technical Analysis

The manifest-like description says the Skill must not be used for posts and describes a known-profile-URL collector. However, its operational workflow and catalog expose username-based collection and post collection.

The catalog-driven builder accepts any listed tool_sign, so this is not merely unused documentation. It allows submission of paid tasks beyond the narrow capability users and orchestrators are told the Skill provides.

Attack Path

  1. The Skill is selected based on its profile-URL-only description.
  2. Its loaded workflow instructs the Agent to offer username and post collection.
  3. The user or Agent selects one of the broader tools.
  4. The helper submits that collection to Dataify using the account token.
  5. The account incurs collection activity and potential credit usage outside the declared purpose.

Impa

...[truncated 277 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove twitter_profile_by-username and twitter_post_by-profileurl from the workflow and catalog if this Skill is intended to remain profile-URL-only.
  • Alternatively, rename and redescribe the Skill so that every executable operation is disclosed.
  • Require explicit user intent before changing from profile collection to post or username collection.
  • Align SKILL.md, SKILL.zh-CN.md, Agent metadata, and references/tool-params.json.
  • Add a launcher-level allowlist that permits only the tool identifiers declared by the Skill.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/business_workflow.py:27
Finding

Unrelated Business-Reconnaissance Workflows Exceed Minimum Required Capability

Content
View full analysis

Vulnerability Details

File Location: scripts/business_workflow.py:27-46, 91-125, 143-183
Vulnerability Type: Excessive bundled network and subprocess capability
Risk Level: Medium

Vulnerable Code

python
CONFIG = {
    "price": {
        "title": "Price Intelligence",
        "input_flag": "--product",
        "input_help": "Product or service to compare.",
    },
    "review": {
        "title": "Review Intelligence",
        "input_flag": "--subject",
        "input_help": "Product, brand, app, or place whose reviews should be analyzed.",
    },
    "lead": {
        "title": "Lead Intelligence",
        "input_flag": "--ideal-customer-profile",
        "input_help": "Ideal customer profile or target-company description.",
    },
    "brand": {
        "title": "Brand Monitoring",
        "input_flag": "--brand",
        "input_help": "Brand to monitor.",
    },
}

The workflow can invoke sibling tools:

python
def execute_action(action: dict[str, Any], token: str) -> subprocess.CompletedProcess[str]:
    invocation = command(action)
    if len(invocation) > 1 and Path(invocation[1]).exists():
        return subprocess.run(invocation, capture_output=True, text=True, encoding="utf-8", errors="replace", check=False)
    if action.get('capability', '').startswith('scraper-'):
        return subprocess.CompletedProcess([], 1, '', 'Required platform scraper is not installed; install it before executing this action.')
    return direct_request(action, token)

Its fallback sends supplied queries and URLs to external Dataify services:

python
request = urllib.request.Request(
    "https://scraperapi.dataify.com/request",
    data=urllib.parse.urlencode(params).encode("utf-8"),
    headers={"Authorization": "Bearer {}".format(token), "Content-Type": "application/x-www-form-urlencoded"},
    method="POST",
)
python
request = ur
...[truncated 1833 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove unrelated price, review, lead, and brand workflows from this narrowly scoped Skill.
  • Publish broader intelligence workflows as separate Skills with accurate descriptions and independent permission review.
  • Do not inherit the profile collector’s token automatically for unrelated operations.
  • Require explicit user authorization before transmitting business subjects, queries, or source URLs.
  • Replace sibling-script discovery with pinned, explicitly declared dependencies.
  • Apply strict URL validation, action-count limits, destination allowlists, and isolated output directories.
  • Execute subprocesses with a reduced environment that omits credentials unless the child process explicitly requires them.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (38)

Tp4

High
Category
MCP Tool Poisoning
Confidence
86% confidence
Finding

The skill can monitor arbitrary Dataify task IDs and retrieve final JSON outputs regardless of the original task type, which exceeds the declared profile-URL-only scope. This makes the context more dangerous because the skill effectively becomes a general task-results client tied to billing credentials and external data transfer.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill can monitor arbitrary Dataify task IDs and retrieve final JSON outputs regardless of the original task type, which exceeds the declared profile-URL-only scope. This makes the context more dangerous because the skill effectively becomes a general task-results client tied to billing credentials and external data transfer.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill can monitor arbitrary Dataify task IDs and retrieve final JSON outputs regardless of the original task type, which exceeds the declared profile-URL-only scope. This makes the context more dangerous because the skill effectively becomes a general task-results client tied to billing credentials and external data transfer.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill can monitor arbitrary Dataify task IDs and retrieve final JSON outputs regardless of the original task type, which exceeds the declared profile-URL-only scope. This makes the context more dangerous because the skill effectively becomes a general task-results client tied to billing credentials and external data transfer.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill can monitor arbitrary Dataify task IDs and retrieve final JSON outputs regardless of the original task type, which exceeds the declared profile-URL-only scope. This makes the context more dangerous because the skill effectively becomes a general task-results client tied to billing credentials and external data transfer.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill can monitor arbitrary Dataify task IDs and retrieve final JSON outputs regardless of the original task type, which exceeds the declared profile-URL-only scope. This makes the context more dangerous because the skill effectively becomes a general task-results client tied to billing credentials and external data transfer.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill can monitor arbitrary Dataify task IDs and retrieve final JSON outputs regardless of the original task type, which exceeds the declared profile-URL-only scope. This makes the context more dangerous because the skill effectively becomes a general task-results client tied to billing credentials and external data transfer.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The workflow explicitly expands the skill to username-based profile collection and post collection, contradicting the metadata that says it should only collect a profile from a known profile URL. This broadening is dangerous because it defeats user expectations and any policy controls derived from the declared scope.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill is named and described as collecting a Twitter/X profile from a known profile URL, but the workflow prompts the user to choose unrelated tools such as username-based profile collection and post-by-profileurl collection. This scope expansion can cause the agent to perform data collection outside the user-approved capability boundary, increasing the chance of over-collection or misuse.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

量，而不是只在当前终端临时设置。

Windows PowerShell，当前用户永久设置：

powershell
[Environment]::SetEnvironmentVariable("DATAIFY_API_TOKEN", "your_token_here", "User")

然后重新打开 PowerShell。如果当前会话也要立即生效，再执行：

powershell
$env:DATAIFY_API_TOKEN = "your_token_here"

macOS 或 Linux，bash 永久设置：

bash
echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.bashrc
source ~/.bashrc

macOS 或 Linux，zsh 永久设置：

bash
echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.zshrc
source ~/.zshrc

脚本用法

Python：

bash
python scripts/build-dataify-request.py --tool-sign <selected_tool_sign> --values-file values.json

PowerShell：

powershell
& ".\scripts\build-dataify-request.ps1" -ToolSign "<selected_tool_sign>" -ValuesFile ".\values.json"

values.json 可以是单个对象，也可以是对象数组。

输出格式

最终 curl 命令应为

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 48)May include surrounding context.

量，而不是只在当前终端临时设置。

Windows PowerShell，当前用户永久设置：

powershell
[Environment]::SetEnvironmentVariable("DATAIFY_API_TOKEN", "your_token_here", "User")

然后重新打开 PowerShell。如果当前会话也要立即生效，再执行：

powershell
$env:DATAIFY_API_TOKEN = "your_token_here"

macOS 或 Linux，bash 永久设置：

bash
echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.bashrc
source ~/.bashrc

macOS 或 Linux，zsh 永久设置：

bash
echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.zshrc
source ~/.zshrc

脚本用法

Python：

bash
python scripts/build-dataify-request.py --tool-sign <selected_tool_sign> --values-file values.json

PowerShell：

powershell
& ".\scripts\build-dataify-request.ps1" -ToolSign "<selected_tool_sign>" -ValuesFile ".\values.json"

values.json 可以是单个对象，也可以是对象数组。

输出格式

最终 curl 命令应为

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The file implements a generic multi-workflow framework for price, review, lead, and brand intelligence, which materially exceeds the declared skill purpose of collecting a Twitter/X profile by known profile URL. This scope mismatch is dangerous because it can cause operators and users to authorize a narrowly described skill that actually supports broader reconnaissance and data collection behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The capability routing includes Amazon review scraping, Google Maps review scraping, Google Shopping, and generic web unlocking, none of which are necessary for collecting a Twitter/X profile from a known profile URL. These unjustified capabilities expand the attack surface and permit collection from unrelated platforms under a misleading skill identity.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The action-construction logic performs broad search-engine discovery, competitor and keyword expansion, and arbitrary source URL ingestion rather than limiting collection to a single known Twitter/X profile URL. In the context of a profile-only skill, this enables unscoped collection and external reconnaissance beyond what the manifest promises.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill declares broad operational behavior involving environment access, file reads, shell usage, and network submission but does not constrain these capabilities with an explicit tool scope. In an agent setting, missing scope increases the chance the skill can be invoked in unintended ways or combined with other instructions to perform actions beyond its stated purpose.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The document first frames the skill as rooted at twitter_profile_by-profileurl, then later instructs the user to choose among multiple different tools. This inconsistency undermines transparency and can cause an operator or calling system to authorize a much broader action set than intended.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The workflow explicitly says to ask the user to choose exactly one tool from a Chinese list, and the listed options are presented only in Chinese. This imposes a language preference without user opt-in and is not justified as a region-specific or compliance-driven constraint.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The skill directs transmission of user-supplied targets and task parameters to an external third-party endpoint, which is a real data egress action. In context this is expected functionality, but it is still security-relevant because the skill's narrow description may not fully convey the breadth of data sent or the possibility of submitting broader scraping jobs.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md
13. Set `spider_name` to `x.com`.
14. Set `spider_id` to the selected tool's `tool_sign`.
15. Always include `spider_errors=true` and `file_name={{TasksID}}`.
16. Return a curl command for `https://scraperapi.dataify.com/builder`.

## Set DATAIFY_API_TOKEN

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The skill is explicitly designed to construct and submit requests to an external service using a bearer token and user-supplied scraping parameters. External transmission is expected in context, but it still represents a real data egress path because selected targets and parameters are sent to a third-party endpoint.

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 3)May include surrounding context.

md
---
name: "dataify-twitter-profile-by-profileurl"
description: "为 x.com 上以 twitter_profile_by-profileurl 为根的 scraper 系列准备 Dataify builder 请求。当需要处理成功的 Dataify scraper detail 条目 twitter_profile_by-profileurl、让用户选择可用工具、读取已保存的 getToolParams 选项，并使用 DATAIFY_API_TOKEN 生成 scraperapi.dataify.com/builder curl 请求时，使用此 skill。"
---

# Dataify Builder Skill 中文版

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The front-matter description claims the skill is rooted in twitter_profile_by-profileurl, but it explicitly refers to a broader scraper family and later instructions support other entry points. This mismatch weakens least-privilege expectations and can mislead downstream agents or reviewers about what the skill is allowed to do.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This file is presented as a Chinese-language skill document, but the 'Account CTA policy' section switches to English instructions and required user-facing wording. Because the skill does not state that the user can choose their preferred language, it may force English output or mixed-language behavior without opt-in, which is a locale policy concern.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.

md
## Account CTA policy

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 111)May include surrounding context.

md
## Account CTA policy

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.

md
- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
- For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management.
- During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 113)May include surrounding context.

md
- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
- For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management.
- During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/task_runtime.py:38