Scraper Walmart Products

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:11 AM UTC
• Version: 1.3.1

Overview

This Walmart data-collection skill is mostly coherent, but it needs review because it has unsafe credential handling and a script import path that can run unreviewed local code.

Review before installing. Use this only in a contained environment, do not paste API tokens into chat, rotate the token if it may have been exposed, and avoid running the bundled scripts until the external sys.path import is removed and task-status/download authentication no longer puts the token in URLs.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/wait_for_task.py:34

Finding

API Token Exposed in URL Query Parameters

Content

View full analysis

") ``` This only redacts occurrences in the response body after the network request has already been sent. It does not prevent the token from appearing in infrastructure logs or request telemetry. Credential transmission is necessary for authenticated polling, but placing the credential in the URL exceeds the minimum exposure necessary. The Builder submission already demonstrates the safer Authorization-header approach. ### Attack Path 1. A user stores a valid token in `DATAIFY_API_TOKEN`. 2. The Skill submits a Walmart collection task. 3. The default completion workflow invokes `wait_for_task`. 4. The script sends requests such as `/ta ...[truncated 953 chars]

Remediation

View remediation

T07 · Tool Hijacking and Spoofing

Error

• Location: scripts/submit_dataify_walmart_products.py:10

Finding

External Sibling Directory Can Shadow the Bundled Task Runtime

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.zh-CN.md:23

Finding

Alternate-Language Instructions Permit API Tokens to Be Supplied Through Chat

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (35)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description promises a narrowly scoped Walmart product record collector, limited to Walmart URLs/categories/SKUs/keywords and explicitly excluding Amazon, eBay, and general shopping-search results. The supplied code does something materially different: it is a reusable business workflow engine supporting multiple modes ('price', 'review', 'lead', 'brand'), generating search actions across Google Search, Google Shopping, and Google News, scraping arbitrary URLs via a web unlocker, and even invoking Amazon review and Google Maps review scrapers for review workflows. It also extracts/analyzes records, applies freshness/geography filters, qualifies leads from LinkedIn/Crunchbase, and generates reports. None of this is Walmart-specific, and several behaviors directly contradict the declaration, especially use of general shopping/search results and Amazon scraping. Therefore the description does not accurately represent the code behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description is narrowly scoped to collecting Walmart product records from Walmart-specific inputs (URL, category URL, SKU, keyword) and explicitly excludes general shopping-search behavior. The supplied code does not implement Walmart-specific record collection. Instead, it is a reusable, domain-agnostic client for Dataify services: one function submits arbitrary Google search queries, and another unlocks arbitrary HTTP(S) URLs for content retrieval. Utility functions normalize any public URL and recursively extract links from generic JSON responses. This is a materially different primary purpose and includes undeclared general web-search and arbitrary webpage retrieval capabilities.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description is a Walmart product-record collection skill with specific input modes (URL, category URL, SKU, keyword). The supplied code does not implement Walmart scraping, product lookup, category handling, SKU handling, or keyword search. Instead, it is generic infrastructure code for parsing a task_id from a response and polling/waiting for task completion. This is a materially different primary purpose from the declared skill behavior, so it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose describes a Walmart product scraping or retrieval capability using various Walmart-specific inputs. The supplied code does not fetch, parse, search, or collect any Walmart product data, nor does it process URLs, SKUs, categories, or keywords. Instead, it provides setup guidance for an API token via environment variables and reports configuration state. This is a materially different primary purpose and introduces undeclared capabilities related to local environment inspection and token setup. Therefore, the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose says the skill collects Walmart product records from URL/category URL/SKU/keyword. This code chunk contains no Walmart-specific logic, no product-query submission, no input handling for URL/category/SKU/keyword, and no filtering to prevent Amazon/eBay/general shopping use. Instead, it polls Dataify endpoints (/task_status and /download) for an existing task ID, handles account/credit/API-key errors, and downloads whatever JSON result the task produced. That is a materially different primary purpose from Walmart record collection, so this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: dataify-walmart-products
description: "提交 Dataify Walmart Product Information Builder 任务，支持四种 Walmart 商品采集模式。当用户需要 Walmart product information collection tool、采集/抓取/爬取 Walmart 商品信息或商品数据，按 URL、category URL、SKU、keyword 采集 Walmart products，创建 walmart_product_by-url、walmart_product_by-category-url、walmart_product_by-sku 或 walmart_product_by-keywords 任务，或表达 Walmart 产品信息采集/抓取、产品采集/抓取、产品 URL/类别 URL/SKU/关键词采集等含义时使用。也用于接收 task_id/status、配�

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 3)May include surrounding context.

md

---
name: dataify-walmart-products
description: "提交 Dataify Walmart Product Information Builder 任务，支持四种 Walmart 商品采集模式。当用户需要 Walmart product information collection tool、采集/抓取/爬取 Walmart 商品信息或商品数据，按 URL、category URL、SKU、keyword 采集 Walmart products，创建 walmart_product_by-url、walmart_product_by-category-url、walmart_product_by-sku 或 walmart_product_by-keywords 任务，或表达 Walmart 产品信息采集/抓取、产品采集/抓取、产品 URL/类别 URL/SKU/关键词采集等含义时使用。也用于接收 task_id/status、配�

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file defines a shared multi-purpose business-intelligence framework with modes for price, review, lead, and brand workflows that far exceed the declared Walmart product collection scope. In a skill advertised as Walmart-only, this creates a scope-deception and capability-expansion risk: the skill can be repurposed to collect unrelated competitive intelligence, reviews, and lead data without user expectation or proper authorization boundaries.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The URL routing explicitly sends review URLs to Amazon and Google Maps review scrapers, directly contradicting the manifest statement not to use the skill for Amazon, eBay, or general shopping-search results. This is dangerous because it embeds undeclared cross-platform scraping capability in a Walmart-labeled skill, increasing the likelihood of unauthorized data collection and trust-boundary violations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The action builder performs general Google Search, Google News, and Google Shopping collection, which is inconsistent with a skill that claims it only collects Walmart product records. This broad web-search capability can be used to gather unrelated third-party information and bypass the narrow constraints users and platform reviewers would expect from the skill description.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The lead-generation workflow collects LinkedIn and Crunchbase organization data, which is unrelated to Walmart product record collection and introduces a materially different data-collection purpose. This unjustified expansion increases privacy, compliance, and abuse risk because the skill can be used for prospecting and company profiling under the cover of an unrelated retail-data skill.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · scripts/submit_dataify_walmart_products.py (reported line 32)May include surrounding context.

python

L = "url"
MODE_CATEGORY_URL = "category-url"
MODE_SKU = "sku"
MODE_KEYWORDS = "keywords"
SPIDER_IDS = {
    MODE_URL: "walmart_product_by-url",
    MODE_CATEGORY_URL: "walmart_product_by-category-url",
    MODE_SKU: "walmart_product_by-sku",
    MODE_KEYWORDS: "walmart_product_by-keywords",
}
DEFAULT_URL = "https://www.walmart.com/ip/HI-CHEW-Stand-Up-Pouch-Getaway-Mix-11-65oz/12284762931?athAsset=eyJhdGhjcGlkIjoiMTIyODQ3NjI5MzEiLCJhdGhzdGlkIjoiQ1MwNTV+Q1MwMDR+Q1MwOTgiLCJhdGhlZSI6eyJhIjoyNy44NCwiYiI6Mjk1MS40MSwidyI6MC4wMDk0MjcxMjc3OTA0NzcxMjMsImwiOjAuNX0sImF0aHBvc2IiOiI4IiwiYXRoYW5jaWQiOiIxMDE2NDUwNzU1IiwiYXRocmsiOjAuMH0%3D&athena=true&adsRedirect=true"
DEFAULT_CATEGORY_URL = "https://www.walmart.com/shop/deals/food/"
DEFAULT_SKU = "439179861"
DEFAULT_KEYWORD = "leggins"
DEFAULT_DOMAIN = "https://www.walmart.com/"
DEFAULT_ALL_VARIATIONS = "false"
DEFAULT_CATEGORY_PAGE_TURNING = "1"
DEFAULT_KEYWORD_PAGE_TURNING = "2"
DEFAULT_FILE_NAME = "{{TasksID}}"
BOOL_VALUES = ("true", "false")


def

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill directs use of environment variables, local files, shell commands, and network requests, but it declares no explicit tool/permission scope. In an agent ecosystem, that omission can cause overbroad execution rights, making it easier for the skill to trigger unintended local or remote actions without clear sandboxing.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 87% confidence

Finding

The instruction to use a locally saved API token without re-asking the user encourages the agent to make authenticated third-party requests based solely on ambient credentials. That can let a prompt or indirect instruction trigger billable external actions under the user's account without fresh consent for the specific transaction.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md

Use `DATAIFY_API_TOKEN` as the long-term saved token name.

- If `DATAIFY_API_TOKEN` is saved locally, use it without asking the user to re-enter the token.
- If the user does not have an API TOKEN, tell them they can register or log in at [Dataify](https://dashboard.dataify.com/login?utm_source=skill) to get one.
- If the user wants to save it, give the appropriate command for their shell and ask them to run it; do not silently persist tokens without confirmation.
- Do not call the Builder endpoint without a token.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md

- If `DATAIFY_API_TOKEN` is saved locally, use it without asking the user to re-enter the token.
- If the user does not have an API TOKEN, tell them they can register or log in at [Dataify](https://dashboard.dataify.com/login?utm_source=skill) to get one.
- If the user wants to save it, give the appropriate command for their shell and ask them to run it; do not silently persist tokens without confirmation.
- Do not call the Builder endpoint without a token.
- Always call it `API TOKEN` in user-facing instructions. Prefer the environment variable name `DATAIFY_API_TOKEN` for saved local use.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs the agent to automatically submit remote scraping jobs and then continue polling/downloading results by default, but it does not prominently warn that user inputs will be transmitted to a third-party service and may incur cost. In an autonomous agent context, silent external submission increases the risk of unintended data disclosure, surprise charges, and actions the user did not realize were happening off-box.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 203)May include surrounding context.

md

## Account CTA policy

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 318)May include surrounding context.

md

## Account CTA policy

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 89% confidence

Finding

Automatically continuing the original task after merely verifying that DATAIFY_API_TOKEN is present removes a meaningful consent checkpoint before authenticated network activity. In practice, this can enable external job submission and billing based on stored credentials and prior conversational context rather than an explicit current approval.

Content

Scanner excerpt · SKILL.md (reported line 205)May include surrounding context.

md

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
- For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management.
- During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger description is very broad and includes many generic shopping and scraping phrases, which can cause the skill to activate in unintended contexts. Over-broad activation increases the chance that user data or unrelated requests are routed to an external scraping workflow without sufficiently specific intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to check for and reuse a locally saved API token without a clear, centralized privacy warning or explicit user-consent boundary for credential reuse. That creates a risk of silent credential usage across tasks, especially if the user does not expect stored secrets to be reused automatically.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill allows users to provide API tokens in the request and use them for the run, which encourages secret submission through chat or other conversational channels. Collecting credentials in conversational context increases the risk of logging, retention, accidental disclosure, or reuse beyond user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document directs the agent to submit scraping parameters to an external service but does not present a clear, centralized data-egress warning. Users may not realize that URLs, SKUs, keywords, and task metadata are being sent to a third party, which creates privacy and compliance risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The troubleshooting flow continues the insecure token-handling pattern by asking about saving the token after discussing token use in chat. This normalizes unsafe secret collection and increases the likelihood that credentials are exposed, stored improperly, or copied into persistent logs.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document earlier instructs the skill to tell users to go to Dataify after successful task creation and even says to 'always' guide them there, but L317 states that during normal submission, processing, and successful completion, the skill should not promote registration or the Dashboard. This is a direct contradiction in operator-facing behavior.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/task_runtime.py:38