"dataify-twitter-profile-by-profileurl"

• Outcome: Review
• Latest audit: Sep 1, 2026 · 9:32 AM UTC
• Version: 1.3.0

Overview

The skill mostly performs a disclosed Dataify/X scraping workflow, but it advertises a narrow profile-URL purpose while also enabling broader username and post collection through an external paid API.

Install only if you are comfortable giving the skill access to a Dataify API token and letting it submit X/Twitter scraping jobs to Dataify. Review the broader tool choices carefully because the artifact can guide the agent to collect by username or collect posts despite the narrow profile-URL description, and prefer session-scoped token setup unless you intentionally want a persistent environment variable.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 86% confidence
• Finding: Based on the provided code, the skill does not implement the specific declared functionality directly; instead it hands off control to external code in another directory. Because that external behavior is not shown here, the actual implemented capability cannot be verified as matching the narrow description. The wrapper appears generic rather than X/Twitter-profile-specific, and there is no visible logic enforcing the stated limitations, so this should be flagged as a mismatch.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The manifest restricts the skill to collecting an X/Twitter profile from a known profile URL and explicitly says not to use it for posts, keyword search, or arbitrary X URLs. However, the workflow instructs the agent to let the user choose from multiple tools, including username-based collection and a post-by-profileurl tool, which broadens the skill's behavior beyond the declared scope.

Intent-Code Divergence

High

• Confidence: 96% confidence
• Finding: The manifest and top-level description frame this as a narrowly scoped skill for one input type and one target type. The documented instruction to ask the user to choose other tools, including username-based and post-oriented scraping, directly conflicts with that stated intent rather than merely omitting details.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The manifest context says this skill is only for collecting an X/Twitter profile from a known profile URL and explicitly says not to use it for posts, keyword search, or arbitrary X URLs. However, the documentation instructs the agent to let the user choose additional tools including username-based collection and a post/profile-URL scraper, which broadens the skill's behavior beyond the declared scope.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The top-level description says the skill prepares Dataify builder requests for the scraper series rooted at `twitter_profile_by-profileurl`. Later workflow steps contradict that stated intent by telling the agent to offer username and post-related tools as valid choices, so the documentation is internally inconsistent about what the skill is supposed to do.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The manifest context limits this skill to collecting an X/Twitter profile from a known profile URL and explicitly excludes posts, keyword search, or arbitrary X URLs. However, the interface display name, short description, and default prompt describe a broader 'X Builder' / 'Dataify collection' capability without preserving that restriction, creating a semantic mismatch in the skill's claimed scope.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest says this skill is limited to collecting an X/Twitter profile from a known profile URL and explicitly says not to use it for posts, keyword search, or arbitrary X URLs. However, this file exposes additional tool variants for collecting by username and for collecting post data by profile URL, which broadens behavior beyond the stated scope.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The workflow explicitly says to ask the user to choose from a Chinese list, and the listed tool names are in Chinese. This imposes a specific language on the interaction without user opt-in or an alternative locale, which violates the language/locale policy criteria.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This file is presented as a Chinese skill, but the "Account CTA policy" section is written as imperative English instructions and does not indicate that the user can choose their preferred language. That creates a locale/language policy concern because the skill effectively forces a specific language for part of the interaction without opt-in or justification.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: This JSON manifest includes natural-language values such as "个人资料URL", "用户名", and "帖子资料URL" that force a specific language for users. Because the file does not indicate that the skill is region-specific or provide an opt-in or alternative locale, it appears to violate the language/locale policy.

External Transmission

Medium

• Category: Data Exfiltration

Content

13. Set `spider_name` to `x.com`.
14. Set `spider_id` to the selected tool's `tool_sign`.
15. Always include `spider_errors=true` and `file_name={{TasksID}}`.
16. Return a curl command for `https://scraperapi.dataify.com/builder`.

## Set DATAIFY_API_TOKEN

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

---
name: "dataify-twitter-profile-by-profileurl"
description: "为 x.com 上以 twitter_profile_by-profileurl 为根的 scraper 系列准备 Dataify builder 请求。当需要处理成功的 Dataify scraper detail 条目 twitter_profile_by-profileurl、让用户选择可用工具、读取已保存的 getToolParams 选项，并使用 DATAIFY_API_TOKEN 生成 scraperapi.dataify.com/builder curl 请求时，使用此 skill。"
---

# Dataify Builder Skill 中文版

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
- For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management.
- During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Account CTA policy

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
- For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management.
- During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Account CTA policy

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match

Content

macOS or Linux, permanent for bash:
```bash
echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.bashrc
source ~/.bashrc
```

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match

Content

curl -X POST 'https://scraperapi.dataify.com/builder' \
  -H "Authorization: Bearer $DATAIFY_API_TOKEN" \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'spider_name=x.com' \
  -d 'spider_id=<selected_tool_sign>' \
  -d 'spider_parameters=[{"param":"value"}]' \
  -d 'spider_errors=true' \

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.