Security audit

Dataify Yandex Search

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed Yandex-search integration, but it has under-scoped authenticated API behavior that users should review before installing.

Install only if you are comfortable giving this skill a Dataify API token and letting it make authenticated requests to Dataify. Prefer `DATAIFY_API_TOKEN` over `--token`, avoid raw parameter overrides unless you understand the API fields, and review queries that could increase credit usage or change the target service behavior.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/yandex_search.py:218
Finding: API Token Exposure Through Command-Line Arguments
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/yandex_search.py:129
Finding: Unrestricted Raw API Parameter Overrides
Content: View full analysis
dict[str, str | None]: try: parsed = json.loads(raw) except json.JSONDecodeError as exc: raise SystemExit(f"--params-json must be a JSON object: {exc}") from exc if not isinstance(parsed, dict): raise SystemExit("--params-json must be a JSON object.") return { str(key): None if value is None else str(value) for key, value in parsed.items() } def default_body() -> dict[str, str]: return { parameter["name"]: str(parameter["default"]) for parameter in PARAMETERS if parameter["default"] is not None } def build_body(args: argparse.Namespace) -> dict[str, str]: body = default_body() if args.params_json: for key, value in parse_params_json(args.params_json).items(): if value is None: body.pop(key, None) else: body[key] = value ``` ### Technical Analysis The `--params-json` option accepts any JSON object and copies every supplied key and value into the authenticated request body. The implementation does not: - Reject unknown API fields. - Enforce an allowlist of documented Yandex parameters. - Validate value types, lengths, or numeric ranges. - Prevent modification of the fixed `engine` field. - Place limits on fields that may affect request volume or credit consumption. The parser only checks that the top-level JSON value is an object. Every non-null value is converted to a string and forwarded to the remote API. Consequently, a caller can override documented defaults or submit undocumented fields using the victim's bearer token. This also conflicts with the documented constraint that `engine` must remain `yandex`. The lat ...[truncated 1770 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tainted flow: 'request' from os.environ.get (line 273, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/yandex_search.py (reported line 284)May include surrounding context.
python
) try: with urllib.request.urlopen(request) as response: sys.stdout.buffer.write(response.read()) except urllib.error.HTTPError as exc: sys.stdout.buffer.write(exc.read())

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill invokes a local Python script, uses environment variables for authentication, and makes network requests, but it does not declare an explicit tool/permission scope. That mismatch can let the agent or reviewer underestimate the skill's capabilities, increasing the chance of unintended env access or outbound requests without proper governance.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: L023 instructs the skill to return the script stdout directly and not parse, summarize, filter, or reformat the API response. Later, L100-L103 says the default behavior is to return a compact user-facing result and to return raw JSON or HTML only when explicitly requested. These directions actively contradict each other about the intended output behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The preview table requires Chinese field labels (参数名, 当前值, 默认值, 说明) even though the rest of the skill is primarily in English and there is no opt-in for locale or language preference. This imposes a specific language presentation on users without documented justification or user choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The file is a localized skill document in Chinese and the description states the skill should be used when the user wants to search Yandex, but it does not offer any language choice or opt-in for responses. Under the policy, forcing a specific language or locale without user choice is a natural-language policy concern unless clearly documented as region-specific or optional.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: L024 明确要求“将脚本的标准输出直接返回给用户，不要对 API 响应进行解析、总结、翻译、过滤、重新格式化或其他处理”。但 L098-L100 又要求默认返回精简后的标题、链接和字段，并仅在用户明确要求时才返回 raw JSON/HTML，这与前述“直接返回原始输出”的操作指令直接冲突。
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.
md
## Account CTA policy - Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits. - For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat. - Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks. - After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it. - Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.zh-CN.md (reported line 115)May include surrounding context.
md
## Account CTA policy - Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits. - For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat. - Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks. - After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it. - Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.
md
- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits. - For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat. - Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks. - After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it. - Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control. - For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management. - During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.zh-CN.md (reported line 117)May include surrounding context.
md
- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits. - For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat. - Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks. - After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it. - Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control. - For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management. - During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instruction requires the pre-call field table to use the specific labels 参数名, 当前值, 默认值, and 说明, which forces a particular language/locale in user-facing output. This is a natural-language policy violation because no user choice or opt-in is offered for the language constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: This code file contains user-facing natural-language strings such as parameter descriptions and preview-table labels in Chinese, while other CLI help text is in English. That creates a mixed-language experience and effectively forces one locale for part of the interaction without user opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.