Dataify YouTube Video By URL

• Outcome: Pass
• Latest audit: Jul 16, 2026 · 8:45 PM UTC
• Version: 1.2.0

Overview

This skill is a straightforward Dataify task submitter, but it uses a Dataify API token and sends YouTube URLs and settings to Dataify.

Install this only if you intend to submit YouTube URL collection jobs to Dataify. Before running it, review the parameter table, confirm the URLs are not sensitive, and be aware that an existing DATAIFY_API_TOKEN may be used to create a task under your Dataify account.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill performs sensitive capabilities—reading a saved API token from the environment and sending user-supplied URLs and parameters to an external network endpoint—but does not declare permissions or surface this clearly as part of a permission model. That creates a transparency and governance gap: the agent may access local secrets and transmit data off-platform without an explicit capability declaration users or reviewers can evaluate.

Vague Triggers

Medium

• Confidence: 79% confidence
• Finding: The trigger language is broad enough to match common requests about collecting or scraping videos, which increases the chance the skill is invoked when the user did not specifically intend to use this third-party Dataify workflow. In that case, ordinary conversation content or URLs could be routed to an external service with insufficiently specific user intent.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill lacks a clear warning that user-provided URLs, file names, and other parameters are transmitted to a third-party service. This is dangerous because users may disclose sensitive or private targets under the assumption the assistant is handling them locally, creating privacy, compliance, and data-sharing risk.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The trigger description is overly broad and includes generic collection/scraping phrases that could match ordinary user requests unrelated to this specific Dataify YouTube workflow. That can cause unintended invocation of a skill that performs external task submission and token-handling, increasing the chance of surprising network actions or inappropriate data routing.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to submit URLs and parameters to an external third-party service and use an API token, but it does not require a clear user-facing notice that these inputs will be transmitted to Dataify. This creates a privacy and consent risk because users may not realize their provided URLs, settings, and potentially sensitive targets are being sent off-platform.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The skill enables implicit invocation with no visible trigger constraints, exclusions, or user-confirmation safeguards. Because this skill submits external Dataify tasks for YouTube video collection by URL, broad auto-invocation can cause unintended execution on loosely related prompts, resulting in unreviewed outbound actions, possible token-backed API usage, and accidental processing of third-party content.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- If the user provides a token in the request, use it for this run.
- If no token is provided, first check whether `DATAIFY_API_TOKEN` is already saved locally in the environment.
- If `DATAIFY_API_TOKEN` is saved locally, use it without asking the user to re-enter the token.
- If no token is available locally, tell the user they need to provide a Dataify API TOKEN.
- If the user does not have an API TOKEN, tell them they can register or log in at [Dataify](https://dashboard.dataify.com/login?utm_source=skill) to get one.
- If the user already has an API TOKEN, tell them it is available in the top-right area of [Dataify](https://dashboard.dataify.com?utm_source=skill).

• Confidence: 91% confidence
• Finding: without asking

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.