Dataify Web Unlocker

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:59 AM UTC
• Version: 1.3.1

Overview

The main Web Unlocker behavior is understandable, but the package also includes broader search and business-scraping workflows plus weak token-handling practices that are not fully disclosed by the skill description.

Review this skill before installing. Use it only for public, non-sensitive webpages, avoid passing session cookies or private headers, prefer session-scoped token setup over writing tokens into shell profiles, and be aware the package contains broader search and business-intelligence scripts beyond the advertised Web Unlocker.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/wait_for_task.py:34

Finding

Reusable API Token Transmitted in URL Query Strings

Content

View full analysis

") ``` That replacement only sanitizes the response body after the request has already been sent. It cannot remove the credential from upstream URL logs or telemetry. This behavior is also inherited by `scripts/task_runtime.py`, which calls `wait_for_task`. Consequently, tasks submitted through `scripts/catalog_builder.py` can reach the same insecure polling path. ### Attack Path 1. A user configures a valid `DATAIFY_API_TOKEN`. 2. The user submits a Builder task or directly runs `wait_for_task.py`. ...[truncated 1023 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:36

Finding

Documentation Encourages Persistent Plaintext Storage of the API Token

Content

View full analysis

> ~/.bashrc source ~/.bashrc ``` macOS or Linux, permanent for zsh: ```bash echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.zshrc source ~/.zshrc ``` ``` The alternate-language instructions contain materially equivalent persistent setup commands. ### Technical Analysis Appending a reusable API token directly to `.bashrc` or `.zshrc` stores it as plaintext in a long-lived startup file. User-scoped persistent Windows environment variables likewise retain the token outside the lifetime of the Skill invocation. This exceeds the minimum credential lifetime necessary to call the API. Persistent plaintext storage increases exposure through: - Dotfile backups and synchronization services. - Accidental publication of shell configuration repositories. - Local malware or another process operating with the user's account permissions. - Support bundles, system diagnostics, and configuration collection tools. - Other interactive programs that inherit the persistent environment. The scripts themselves only require the token to exist in the process environment during an API request. Therefore, perman ...[truncated 1308 chars]

Remediation

View remediation

other

Warning

• Location: scripts/business_workflow.py:26

Finding

Bundled Business-Intelligence Workflow Exceeds the Declared Web-Unlocker Scope

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (29)

Tainted flow: 'request' from os.environ.get (line 89, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/invoke-dataify-web-unlocker.py (reported line 100)May include surrounding context.

python

)

    try:
        with urllib.request.urlopen(request) as response:
            content = response.read()
            if not content:
                print(response.status)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is narrow: a Web Unlocker utility for retrieving HTML or screenshots from known blocked or JS-rendered pages. The supplied code instead acts as a shared orchestration framework for several business workflows. It plans actions, invokes search capabilities for discovery, adds detail-page collection actions, falls back to direct API requests, extracts structured records, evaluates freshness/geography, computes analysis metrics, enforces acceptance criteria, and emits reports. Although Web Unlocker is one fallback/detail capability used for some URL actions, it is only a subset of the behavior. The code also explicitly uses search-engine discovery and platform-specific structured scraping, contradicting the stated restrictions. Therefore the description does not accurately represent the actual behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description is narrowly about a specific Web Unlocker capability: retrieving HTML or screenshots from blocked or JavaScript-rendered webpages. The code, however, is a reusable builder submission client. It accepts an arbitrary tool_sign, loads matching tool metadata from a catalog file, validates whatever parameters that tool requires, and submits the request to a generic Builder endpoint. Nothing in the code restricts usage to Web Unlocker, webpage fetches, HTML, screenshots, blocked pages, or JS-rendered pages. Its primary behavior is broader orchestration of catalog-defined Dataify tasks, potentially including many unrelated scraping/extraction tools. That is a material mismatch in purpose and capability, not just an implementation detail.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description is narrowly about using Dataify Web Unlocker to fetch content from a known blocked or JS-rendered page and explicitly says not to use it for search-engine discovery. However, the code includes a separate search() function that sends Google search queries to https://scraperapi.dataify.com/request, and urls_from_search() parses and extracts result URLs from SERP responses. That is a materially undeclared capability and directly conflicts with the description's stated limitation against search-engine discovery. The unlock-related behavior is consistent with the description, but the presence of SERP querying makes the overall implementation a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description is about web page retrieval via Dataify Web Unlocker, specifically fetching HTML or screenshots from difficult webpages. The supplied code does not fetch webpages, render JavaScript, capture screenshots, or interact with Web Unlocker-specific page retrieval. Instead, it is a generic support module for handling asynchronous task completion: parsing task IDs, calling wait_for_task, and formatting success/error outputs. This is a materially different primary purpose, so the description does not accurately represent the code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is about a web-unlocking/fetching capability for blocked or dynamic webpages. The supplied code does something materially different: it is a local helper script that detects platform/shell, checks whether DATAIFY_API_TOKEN is configured, and outputs setup/verification commands. It performs no webpage retrieval, screenshotting, CAPTCHA handling, SPA rendering, or network access. This is a clear description-behavior mismatch with a different primary purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a webpage retrieval skill using Dataify Web Unlocker, implying submission/fetching of page content such as HTML or screenshots from difficult sites. The supplied code instead acts as a task-waiting utility: it repeatedly queries Dataify's task_status endpoint for a provided task ID and then downloads the result as JSON from the download endpoint. It never accepts a target URL, never requests HTML or screenshot output, and its primary purpose is orchestration of an already-submitted asynchronous task. This is a materially different primary behavior from the declared purpose, so it is a mismatch.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

量，而不是只在当前终端临时设置。

Windows PowerShell，当前用户永久设置：

powershell

[Environment]::SetEnvironmentVariable("DATAIFY_API_TOKEN", "your_token_here", "User")

然后重新打开 PowerShell。如果当前会话也要立即生效，再执行：

powershell

$env:DATAIFY_API_TOKEN = "your_token_here"

macOS 或 Linux，bash 永久设置：

bash

echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.bashrc
source ~/.bashrc

macOS 或 Linux，zsh 永久设置：

bash

echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.zshrc
source ~/.zshrc

默认请求体

除非用户明确要求不同取值，否则使用以下默认值。真正发起请求前，只必须先拿到 url：

json

{
  "url": "https://www.google.com",
  "type": "html",
  "js_render": "True",
  "block_resources": "",
  "clean_content": "",
  "country": "us",
  "headers": "",
  "cookies": "",
  "wait": "",
  "wait_for": "",
  "follow_redirect": "Tr

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 40)May include surrounding context.

量，而不是只在当前终端临时设置。

Windows PowerShell，当前用户永久设置：

powershell

[Environment]::SetEnvironmentVariable("DATAIFY_API_TOKEN", "your_token_here", "User")

然后重新打开 PowerShell。如果当前会话也要立即生效，再执行：

powershell

$env:DATAIFY_API_TOKEN = "your_token_here"

macOS 或 Linux，bash 永久设置：

bash

echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.bashrc
source ~/.bashrc

macOS 或 Linux，zsh 永久设置：

bash

echo 'export DATAIFY_API_TOKEN="your_token_here"' >> ~/.zshrc
source ~/.zshrc

默认请求体

除非用户明确要求不同取值，否则使用以下默认值。真正发起请求前，只必须先拿到 url：

json

{
  "url": "https://www.google.com",
  "type": "html",
  "js_render": "True",
  "block_resources": "",
  "clean_content": "",
  "country": "us",
  "headers": "",
  "cookies": "",
  "wait": "",
  "wait_for": "",
  "follow_redirect": "Tr

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file is packaged as part of a narrowly described Web Unlocker skill, but it actually orchestrates multiple unrelated capabilities including Google search, Google Shopping, Google News, Amazon comments, and Google Maps reviews. This is dangerous because it creates a scope-expansion and capability-confusion issue: users may invoke or install the skill expecting blocked-page HTML retrieval, while the code performs broader discovery and scraping workflows that materially exceed the stated purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The workflow constructs search-engine discovery actions for Google Search, Google Shopping, and Google News even though the skill description explicitly says not to use it for search-engine discovery. This mismatch is dangerous because it can lead to unauthorized data collection behavior, policy bypass, and user deception about what data is being sent to external services and what actions the skill may take.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

For review workflows, the code conditionally routes Amazon and Google Maps URLs into platform-specific structured scrapers, despite the skill description saying it should not be used for platform-specific structured records. This is dangerous because it silently broadens collection into specialized scraping paths that users and reviewers would not reasonably expect from a generic Web Unlocker skill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file exposes a search() function that queries a Google SERP endpoint even though the skill is described as a web unlocker for known target pages, not a search-discovery tool. This expands the skill from content retrieval into discovery/enumeration, enabling automated targeting of arbitrary sites and undermining policy or product constraints stated in the skill description.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code not only performs search discovery but also parses and extracts URLs from search results via urls_from_search(), creating a pipeline for automated reconnaissance followed by fetching. In the context of a web unlocker, this makes the skill materially more dangerous because it can be used to discover and then access blocked or protected pages at scale, contrary to the stated purpose limitation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill instructs use of environment variables, shell commands, network calls, and local scripts, but it declares no explicit tool scope or permissions. That mismatch weakens sandboxing and review because an agent may execute broader capabilities than a consumer of the skill would expect.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The skill sends user-supplied URLs, optional headers, and cookies to an external third-party service. That is an intentional feature, but it creates real data-exfiltration and privacy risk if users pass sensitive internal URLs, session cookies, or proprietary headers through the unlocker API.

Content

Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.

& ".\scripts\invoke-dataify-web-unlocker.ps1" -Url "https://example.com" -DryRun

text

## Raw curl fallback

If the user explicitly wants the raw request, use `curl.exe` in PowerShell, not `curl`, to avoid the PowerShell alias ambiguity.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 120)May include surrounding context.

& ".\scripts\invoke-dataify-web-unlocker.ps1" -Url "https://example.com" -DryRun

text

## 原始 curl 回退方式

如果用户明确要求原始请求，在 PowerShell 中请使用 `curl.exe`，避免命中 PowerShell 的 `curl` 别名。

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This is a Chinese-language skill file, but the "Account CTA policy" section is written as imperative English instructions without offering a language choice. That creates a locale/language policy inconsistency and may cause the agent to respond in English even when the surrounding skill and user context are Chinese.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

md

## Account CTA policy

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 164)May include surrounding context.

md

## Account CTA policy

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 181)May include surrounding context.

md

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
- For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management.
- During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 166)May include surrounding context.

md

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts get 50 free credits, enough for about 6,000 trial results, valid for 7 days, and only successful requests are billed. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
- For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management.
- During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The fallback path claims to be a standalone Web Unlocker mode, but still sends search-engine queries and broader scraping requests to Dataify endpoints based on action type and capability. That makes the fallback behavior materially broader than advertised, increasing the risk that deployment without the full repository still performs undeclared discovery and scraping operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The code transmits user-supplied queries, URLs, and geography values to external Dataify endpoints for search and unlocking, but this file provides no user-facing consent, minimization, or disclosure beyond requiring an API token. In the context of a skill whose manifest narrowly describes page unlocking, this external transmission is more sensitive because inputs may contain proprietary targets, business leads, or monitoring subjects that users did not expect to be routed into broader search/scraping services.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/business_workflow.py (reported line 180)May include surrounding context.

python

def execute_action(action: dict[str, Any], token: str) -> subprocess.CompletedProcess[str]:
    invocation = command(action)
    if len(invocation) > 1 and Path(invocation[1]).exists():
        return subprocess.run(invocation, capture_output=True, text=True, encoding="utf-8", errors="replace", check=False)
    if action.get('capability', '').startswith('scraper-'):
        return subprocess.CompletedProcess([], 1, '', 'Required platform scraper is not installed; install it before executing this action.')
    return direct_request(action, token)

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/task_runtime.py:38