📦
Audit History
datadata-api - 4 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v4 Latest | Jul 6, 2026, 10:09 AM | 3 confirmed | 46 | No capability change |
| v3 | Jul 6, 2026, 10:09 AM | 3 confirmed | 46 | External commands Contains scripts |
| v2 | Jun 29, 2026, 10:42 AM | 1 confirmed | 4 | Contains scripts External commands |
| v1 | May 22, 2026, 01:26 AM | No confirmed findings | 0 | Baseline |
Audit version 4 Latest
Jul 6, 2026, 10:09 AM
The skill is Datadata-focused and I found no prompt injection or hidden payloads. Most static alerts are false positives from markdown backticks, Chinese documentation, placeholders, and Datadata resource IDs. Confirmed issues involve authenticated network use, local credential storage, API key exposure in device-flow output, broad default permissions, and local result-file writes.
7
Files scanned
2,698
Lines analyzed
53
Review items
0
False positives ignored
Confirmed security concerns (3)
High
Full API Key Exposed In Device Flow Output
The device-flow completion path returns the full API key in command output, and a fallback path prints the key if saving fails. Command output can persist in logs or agent transcripts.
The code explicitly includes the key in printed output fields and fallback messages. This is direct credential disclosure, even though it occurs during a legitimate auth flow.
High
Broad Default Device Authorization Scope
The default device-flow key requests read, scan, replace-file, query execution, result access, and data-space write permissions for every authorization. Read-only workflows receive write-capable credentials.
The permission list is hardcoded and reused for both device-flow entry points. It includes write and replace-file scopes beyond many documented read-only tasks.
Medium
Unconstrained Result Artifact Write Path
The result download command writes to a user-supplied output path or a default path built from the execution ID. The execution ID is not sanitized before becoming part of a filesystem path.
The code joins the execution ID into a temp filename and then opens the resolved path for writing. Legitimate IDs are likely safe, but the CLI does not enforce that format.
Capability review items (46)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Generic API/secret keys
print(f"获取到 API Key: {api_key}")
The API reference example prints the full API key after device-flow token exchange. This can teach users or agents to leak a newly issued credential into logs or chat transcripts.
High
Hidden file in home directory
3. `~/.config/datadata/datadata-api-skills/config.json` 配置文件
The CLI documentation describes persistent API key storage under a hidden config path. The documented 0600 permission reduces exposure, but this is still sensitive filesystem behavior.
High
Hidden file in home directory
5. API Key 自动保存到 `~/.config/datadata/datadata-api-skills/config.json`(Unix 权限 0600),后续直接使用,无需重复授权
The CLI documentation describes persistent API key storage under a hidden config path. The documented 0600 permission reduces exposure, but this is still sensitive filesystem behavior.
High
Hidden file in home directory
其他: ~/.config/datadata/datadata-api-skills
The script stores Datadata authentication material under a hidden user config directory. The Unix permission hardening helps, but persistent local secret storage remains sensitive.
High
Hidden file access
其他: ~/.config/datadata/datadata-api-skills
The script stores Datadata authentication material under a hidden user config directory. The Unix permission hardening helps, but persistent local secret storage remains sensitive.
High
Python file write/append
with open(API_KEY_CONFIG_FILE, "w", encoding="utf-8") as fh:
The script stores Datadata authentication material under a hidden user config directory. The Unix permission hardening helps, but persistent local secret storage remains sensitive.
High
Python environment access
default=os.environ.get("DATADATA_API_KEY") or load_api_key_from_config() or "",
The script reads DATADATA_API_KEY from the environment and uses it for authenticated requests. Environment-based secret access is expected but sensitive.
High
Python environment access
env_key = os.environ.get("DATADATA_API_KEY")
The script reads DATADATA_API_KEY from the environment and uses it for authenticated requests. Environment-based secret access is expected but sensitive.
High
Configuration library
api_key = config.get("apiKey") if isinstance(config, dict) else None
The script reads the saved apiKey value from the local config file. This is intentional credential loading, but it handles a reusable secret.
High
Configuration library
return config.get("apiKey") if isinstance(config, dict) else None
The script reads the saved apiKey value from the local config file. This is intentional credential loading, but it handles a reusable secret.
High
Generic API/secret keys
default=os.environ.get("DATADATA_API_KEY") or load_api_key_from_config() or "",
The script reads DATADATA_API_KEY from the environment and treats it as an authentication secret. This is legitimate configuration but still secret access.
High
Generic API/secret keys
parser.add_argument("--api-key", default=global_opts.api_key)
The script accepts or handles a Datadata API key as part of its authentication flow. This is expected but security-sensitive credential handling.
High
Generic API/secret keys
if api_key:
The script places the Datadata API key into request headers for outbound HTTP calls. This is required for authentication, but it is sensitive if the base URL is misconfigured.
High
Generic API/secret keys
headers["X-Datadata-Api-key"] = api_key
The script places the Datadata API key into request headers for outbound HTTP calls. This is required for authentication, but it is sensitive if the base URL is misconfigured.
High
Generic API/secret keys · 2 occurrences
headers={"X-Datadata-Api-key": api_key, "Accept": "*/*"},
The script places the Datadata API key into request headers for outbound HTTP calls. This is required for authentication, but it is sensitive if the base URL is misconfigured.
High
Generic API/secret keys · 2 occurrences
with open(API_KEY_CONFIG_FILE, "r", encoding="utf-8") as fh:
The script reads or writes a persisted Datadata API key in the local config file. Local persistence is useful but creates a credential exposure surface.
High
Generic API/secret keys
api_key = config.get("apiKey") if isinstance(config, dict) else None
The script reads or writes a persisted Datadata API key in the local config file. Local persistence is useful but creates a credential exposure surface.
High
Generic API/secret keys
return api_key
The script reads or writes a persisted Datadata API key in the local config file. Local persistence is useful but creates a credential exposure surface.
High
Generic API/secret keys
def save_api_key_to_config(api_key: str) -> None:
The script reads or writes a persisted Datadata API key in the local config file. Local persistence is useful but creates a credential exposure surface.
High
Generic API/secret keys
"apiKey": api_key,
The script reads or writes a persisted Datadata API key in the local config file. Local persistence is useful but creates a credential exposure surface.
High
Generic API/secret keys
with open(API_KEY_CONFIG_FILE, "w", encoding="utf-8") as fh:
The script reads or writes a persisted Datadata API key in the local config file. Local persistence is useful but creates a credential exposure surface.
High
Generic API/secret keys · 2 occurrences
api_key = result.get("key")
The device-flow path receives and stores a newly issued Datadata API key. This is expected, but it handles a fresh reusable credential.
High
Generic API/secret keys · 2 occurrences
save_api_key_to_config(api_key)
The device-flow path receives and stores a newly issued Datadata API key. This is expected, but it handles a fresh reusable credential.
High
Generic API/secret keys
print(f"✅ 授权成功!API Key: {api_key}", file=sys.stderr)
The script can print or return the full Datadata API key in command output. That exposes a reusable credential to terminal logs, chat transcripts, or command capture.
High
Generic API/secret keys
"提示:可通过 export DATADATA_API_KEY='{}' 手动设置。".format(api_key),
The script can print or return the full Datadata API key in command output. That exposes a reusable credential to terminal logs, chat transcripts, or command capture.
High
Generic API/secret keys
"key": api_key,
The script can print or return the full Datadata API key in command output. That exposes a reusable credential to terminal logs, chat transcripts, or command capture.
High
Generic API/secret keys
env_key = os.environ.get("DATADATA_API_KEY")
The script reads DATADATA_API_KEY from the environment and treats it as an authentication secret. This is legitimate configuration but still secret access.
Medium
Hidden file access
3. `~/.config/datadata/datadata-api-skills/config.json` 配置文件
The CLI documentation describes persistent API key storage under a hidden config path. The documented 0600 permission reduces exposure, but this is still sensitive filesystem behavior.
Medium
Hidden file access
5. API Key 自动保存到 `~/.config/datadata/datadata-api-skills/config.json`(Unix 权限 0600),后续直接使用,无需重复授权
The CLI documentation describes persistent API key storage under a hidden config path. The documented 0600 permission reduces exposure, but this is still sensitive filesystem behavior.
Medium
Python file write/append
with open(DEVICE_FLOW_STATE_FILE, "w", encoding="utf-8") as fh:
The script creates or writes Datadata config, device-flow state, or result files on disk. This is intended behavior, but it can persist sensitive data or overwrite files if misused.
Medium
Python file write/append
with open(path, "wb") as fh:
The script creates or writes Datadata config, device-flow state, or result files on disk. This is intended behavior, but it can persist sensitive data or overwrite files if misused.
Medium
Python os file operations
os.makedirs(API_KEY_CONFIG_DIR, mode=0o700, exist_ok=True)
The script creates or writes Datadata config, device-flow state, or result files on disk. This is intended behavior, but it can persist sensitive data or overwrite files if misused.
Low
Python HTTP libraries
import urllib.request
The Python CLI performs real HTTP requests to the configured Datadata base URL. This is intended behavior, but it transmits queries, metadata requests, and authenticated headers over the network.
Low
Python HTTP libraries
req = urllib.request.Request(url, data=data, headers=headers, method=method)
The Python CLI performs real HTTP requests to the configured Datadata base URL. This is intended behavior, but it transmits queries, metadata requests, and authenticated headers over the network.
Low
Python HTTP libraries · 3 occurrences
with urllib.request.urlopen(req) as resp:
The Python CLI performs real HTTP requests to the configured Datadata base URL. This is intended behavior, but it transmits queries, metadata requests, and authenticated headers over the network.
Low
Python HTTP libraries · 2 occurrences
req = urllib.request.Request(
The Python CLI performs real HTTP requests to the configured Datadata base URL. This is intended behavior, but it transmits queries, metadata requests, and authenticated headers over the network.
Low
Hardcoded URL
default=os.environ.get("DATADATA_BASE_URL", "https://www.datadata.com"),
The Python CLI performs real HTTP requests to the configured Datadata base URL. This is intended behavior, but it transmits queries, metadata requests, and authenticated headers over the network.
Low
Temp file creation
return os.path.join(tempfile.gettempdir(), f"datadata-{execution_id}{suffix}")
The result download path is built in the system temp directory by default. This is expected for exports, but it still writes data artifacts to local storage.
Low
Python environment access
default=os.environ.get("DATADATA_BASE_URL", "https://www.datadata.com"),
The script reads DATADATA_BASE_URL from the environment, which controls the remote endpoint. This is intended for configuration, but a bad value can redirect requests.
Risk Factors
⚙️ External commands (36)
agents/openai.yaml:9 agents/openai.yaml:11 agents/openai.yaml:13 agents/openai.yaml:17 agents/openai.yaml:21 agents/openai.yaml:25 SKILL.md:12 SKILL.md:14 SKILL.md:21 SKILL.md:25 SKILL.md:29 SKILL.md:49 SKILL.md:50 SKILL.md:51 SKILL.md:57 SKILL.md:58 SKILL.md:60 SKILL.md:64 SKILL.md:79 SKILL.md:83 SKILL.md:87 SKILL.md:88 SKILL.md:89 SKILL.md:106 SKILL.md:113 SKILL.md:114 SKILL.md:115 SKILL.md:116 SKILL.md:117 SKILL.md:121 SKILL.md:125 SKILL.md:126 SKILL.md:128 SKILL.md:132 SKILL.md:133 SKILL.md:136
🌐 Network access (39)
agents/openai.yaml:13 references/api.md:24 references/api.md:75 references/api.md:94 references/api.md:115 references/api.md:150 references/api.md:202 references/api.md:233 references/api.md:274 references/api.md:355 references/api.md:386 references/api.md:413 references/api.md:456 references/api.md:501 references/api.md:527 references/api.md:565 references/api.md:14 references/api.md:19 references/api.md:29 references/api.md:30 references/api.md:302 references/api.md:303 references/api.md:22 references/cli.md:43 references/cli.md:59 references/cli.md:43 references/cli.md:59 references/data-spaces.md:45 scripts/datadata_query.py:14 scripts/datadata_query.py:298 scripts/datadata_query.py:300 scripts/datadata_query.py:316 scripts/datadata_query.py:322 scripts/datadata_query.py:332 scripts/datadata_query.py:338 scripts/datadata_query.py:23 scripts/datadata_query.py:1339 SKILL.md:29 SKILL.md:58
📁 Filesystem access (19)
references/api.md:301 references/api.md:312 references/cli.md:20 references/cli.md:33 references/cli.md:37 references/cli.md:20 references/cli.md:33 references/cli.md:37 scripts/datadata_query.py:370 scripts/datadata_query.py:370 scripts/datadata_query.py:10 scripts/datadata_query.py:827 scripts/datadata_query.py:432 scripts/datadata_query.py:459 scripts/datadata_query.py:831 scripts/datadata_query.py:391 scripts/datadata_query.py:437 scripts/datadata_query.py:443 scripts/datadata_query.py:496
🔑 Env variables (130)
references/api.md:21 references/api.md:25 references/api.md:233 references/api.md:302 references/api.md:529 references/api.md:530 references/cli.md:10 references/cli.md:19 references/cli.md:42 references/cli.md:58 scripts/datadata_query.py:23 scripts/datadata_query.py:27 scripts/datadata_query.py:373 scripts/datadata_query.py:1152 scripts/datadata_query.py:402 scripts/datadata_query.py:407 scripts/datadata_query.py:1178 scripts/datadata_query.py:27 scripts/datadata_query.py:33 scripts/datadata_query.py:179 scripts/datadata_query.py:181 scripts/datadata_query.py:186 scripts/datadata_query.py:191 scripts/datadata_query.py:196 scripts/datadata_query.py:206 scripts/datadata_query.py:210 scripts/datadata_query.py:213 scripts/datadata_query.py:220 scripts/datadata_query.py:231 scripts/datadata_query.py:239 scripts/datadata_query.py:252 scripts/datadata_query.py:260 scripts/datadata_query.py:267 scripts/datadata_query.py:275 scripts/datadata_query.py:282 scripts/datadata_query.py:289 scripts/datadata_query.py:293 scripts/datadata_query.py:294 scripts/datadata_query.py:315 scripts/datadata_query.py:318 scripts/datadata_query.py:331 scripts/datadata_query.py:334 scripts/datadata_query.py:360 scripts/datadata_query.py:363 scripts/datadata_query.py:381 scripts/datadata_query.py:382 scripts/datadata_query.py:385 scripts/datadata_query.py:390 scripts/datadata_query.py:391 scripts/datadata_query.py:394 scripts/datadata_query.py:397 scripts/datadata_query.py:402 scripts/datadata_query.py:403 scripts/datadata_query.py:414 scripts/datadata_query.py:415 scripts/datadata_query.py:420 scripts/datadata_query.py:423 scripts/datadata_query.py:429 scripts/datadata_query.py:432 scripts/datadata_query.py:437 scripts/datadata_query.py:440 scripts/datadata_query.py:443 scripts/datadata_query.py:501 scripts/datadata_query.py:506 scripts/datadata_query.py:567 scripts/datadata_query.py:579 scripts/datadata_query.py:586 scripts/datadata_query.py:600 scripts/datadata_query.py:601 scripts/datadata_query.py:603 scripts/datadata_query.py:605 scripts/datadata_query.py:608 scripts/datadata_query.py:611 scripts/datadata_query.py:614 scripts/datadata_query.py:623 scripts/datadata_query.py:638 scripts/datadata_query.py:646 scripts/datadata_query.py:696 scripts/datadata_query.py:697 scripts/datadata_query.py:709 scripts/datadata_query.py:710 scripts/datadata_query.py:718 scripts/datadata_query.py:780 scripts/datadata_query.py:795 scripts/datadata_query.py:809 scripts/datadata_query.py:816 scripts/datadata_query.py:818 scripts/datadata_query.py:849 scripts/datadata_query.py:850 scripts/datadata_query.py:863 scripts/datadata_query.py:883 scripts/datadata_query.py:890 scripts/datadata_query.py:899 scripts/datadata_query.py:911 scripts/datadata_query.py:963 scripts/datadata_query.py:975 scripts/datadata_query.py:983 scripts/datadata_query.py:1000 scripts/datadata_query.py:1005 scripts/datadata_query.py:1008 scripts/datadata_query.py:1032 scripts/datadata_query.py:1047 scripts/datadata_query.py:1097 scripts/datadata_query.py:1100 scripts/datadata_query.py:1107 scripts/datadata_query.py:1126 scripts/datadata_query.py:1143 scripts/datadata_query.py:1145 scripts/datadata_query.py:1148 scripts/datadata_query.py:1149 scripts/datadata_query.py:1152 scripts/datadata_query.py:1153 scripts/datadata_query.py:1157 scripts/datadata_query.py:1162 scripts/datadata_query.py:1176 scripts/datadata_query.py:1221 scripts/datadata_query.py:1222 scripts/datadata_query.py:1224 scripts/datadata_query.py:1228 scripts/datadata_query.py:1271 scripts/datadata_query.py:1279 scripts/datadata_query.py:1310 scripts/datadata_query.py:1328 scripts/datadata_query.py:1342 scripts/datadata_query.py:1348 scripts/datadata_query.py:1349 scripts/datadata_query.py:1355 scripts/datadata_query.py:1358 scripts/datadata_query.py:1362 SKILL.md:57
Audited by: codex
Jul 6, 2026, 10:09 AM
The skill is Datadata-focused and I found no prompt injection or hidden payloads. Most static alerts are false positives from markdown backticks, Chinese documentation, placeholders, and Datadata resource IDs. Confirmed issues involve authenticated network use, local credential storage, API key exposure in device-flow output, broad default permissions, and local result-file writes.
7
Files scanned
2,698
Lines analyzed
53
Review items
0
False positives ignored
Confirmed security concerns (3)
High
Full API Key Exposed In Device Flow Output
The device-flow completion path returns the full API key in command output, and a fallback path prints the key if saving fails. Command output can persist in logs or agent transcripts.
The code explicitly includes the key in printed output fields and fallback messages. This is direct credential disclosure, even though it occurs during a legitimate auth flow.
High
Broad Default Device Authorization Scope
The default device-flow key requests read, scan, replace-file, query execution, result access, and data-space write permissions for every authorization. Read-only workflows receive write-capable credentials.
The permission list is hardcoded and reused for both device-flow entry points. It includes write and replace-file scopes beyond many documented read-only tasks.
Medium
Unconstrained Result Artifact Write Path
The result download command writes to a user-supplied output path or a default path built from the execution ID. The execution ID is not sanitized before becoming part of a filesystem path.
The code joins the execution ID into a temp filename and then opens the resolved path for writing. Legitimate IDs are likely safe, but the CLI does not enforce that format.
Capability review items (46)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Generic API/secret keys
print(f"获取到 API Key: {api_key}")
The API reference example prints the full API key after device-flow token exchange. This can teach users or agents to leak a newly issued credential into logs or chat transcripts.
High
Hidden file in home directory
3. `~/.config/datadata/datadata-api-skills/config.json` 配置文件
The CLI documentation describes persistent API key storage under a hidden config path. The documented 0600 permission reduces exposure, but this is still sensitive filesystem behavior.
High
Hidden file in home directory
5. API Key 自动保存到 `~/.config/datadata/datadata-api-skills/config.json`(Unix 权限 0600),后续直接使用,无需重复授权
The CLI documentation describes persistent API key storage under a hidden config path. The documented 0600 permission reduces exposure, but this is still sensitive filesystem behavior.
High
Hidden file in home directory
其他: ~/.config/datadata/datadata-api-skills
The script stores Datadata authentication material under a hidden user config directory. The Unix permission hardening helps, but persistent local secret storage remains sensitive.
High
Hidden file access
其他: ~/.config/datadata/datadata-api-skills
The script stores Datadata authentication material under a hidden user config directory. The Unix permission hardening helps, but persistent local secret storage remains sensitive.
High
Python file write/append
with open(API_KEY_CONFIG_FILE, "w", encoding="utf-8") as fh:
The script stores Datadata authentication material under a hidden user config directory. The Unix permission hardening helps, but persistent local secret storage remains sensitive.
High
Python environment access
default=os.environ.get("DATADATA_API_KEY") or load_api_key_from_config() or "",
The script reads DATADATA_API_KEY from the environment and uses it for authenticated requests. Environment-based secret access is expected but sensitive.
High
Python environment access
env_key = os.environ.get("DATADATA_API_KEY")
The script reads DATADATA_API_KEY from the environment and uses it for authenticated requests. Environment-based secret access is expected but sensitive.
High
Configuration library
api_key = config.get("apiKey") if isinstance(config, dict) else None
The script reads the saved apiKey value from the local config file. This is intentional credential loading, but it handles a reusable secret.
High
Configuration library
return config.get("apiKey") if isinstance(config, dict) else None
The script reads the saved apiKey value from the local config file. This is intentional credential loading, but it handles a reusable secret.
High
Generic API/secret keys
default=os.environ.get("DATADATA_API_KEY") or load_api_key_from_config() or "",
The script reads DATADATA_API_KEY from the environment and treats it as an authentication secret. This is legitimate configuration but still secret access.
High
Generic API/secret keys
parser.add_argument("--api-key", default=global_opts.api_key)
The script accepts or handles a Datadata API key as part of its authentication flow. This is expected but security-sensitive credential handling.
High
Generic API/secret keys
if api_key:
The script places the Datadata API key into request headers for outbound HTTP calls. This is required for authentication, but it is sensitive if the base URL is misconfigured.
High
Generic API/secret keys
headers["X-Datadata-Api-key"] = api_key
The script places the Datadata API key into request headers for outbound HTTP calls. This is required for authentication, but it is sensitive if the base URL is misconfigured.
High
Generic API/secret keys · 2 occurrences
headers={"X-Datadata-Api-key": api_key, "Accept": "*/*"},
The script places the Datadata API key into request headers for outbound HTTP calls. This is required for authentication, but it is sensitive if the base URL is misconfigured.
High
Generic API/secret keys · 2 occurrences
with open(API_KEY_CONFIG_FILE, "r", encoding="utf-8") as fh:
The script reads or writes a persisted Datadata API key in the local config file. Local persistence is useful but creates a credential exposure surface.
High
Generic API/secret keys
api_key = config.get("apiKey") if isinstance(config, dict) else None
The script reads or writes a persisted Datadata API key in the local config file. Local persistence is useful but creates a credential exposure surface.
High
Generic API/secret keys
return api_key
The script reads or writes a persisted Datadata API key in the local config file. Local persistence is useful but creates a credential exposure surface.
High
Generic API/secret keys
def save_api_key_to_config(api_key: str) -> None:
The script reads or writes a persisted Datadata API key in the local config file. Local persistence is useful but creates a credential exposure surface.
High
Generic API/secret keys
"apiKey": api_key,
The script reads or writes a persisted Datadata API key in the local config file. Local persistence is useful but creates a credential exposure surface.
High
Generic API/secret keys
with open(API_KEY_CONFIG_FILE, "w", encoding="utf-8") as fh:
The script reads or writes a persisted Datadata API key in the local config file. Local persistence is useful but creates a credential exposure surface.
High
Generic API/secret keys · 2 occurrences
api_key = result.get("key")
The device-flow path receives and stores a newly issued Datadata API key. This is expected, but it handles a fresh reusable credential.
High
Generic API/secret keys · 2 occurrences
save_api_key_to_config(api_key)
The device-flow path receives and stores a newly issued Datadata API key. This is expected, but it handles a fresh reusable credential.
High
Generic API/secret keys
print(f"✅ 授权成功!API Key: {api_key}", file=sys.stderr)
The script can print or return the full Datadata API key in command output. That exposes a reusable credential to terminal logs, chat transcripts, or command capture.
High
Generic API/secret keys
"提示:可通过 export DATADATA_API_KEY='{}' 手动设置。".format(api_key),
The script can print or return the full Datadata API key in command output. That exposes a reusable credential to terminal logs, chat transcripts, or command capture.
High
Generic API/secret keys
"key": api_key,
The script can print or return the full Datadata API key in command output. That exposes a reusable credential to terminal logs, chat transcripts, or command capture.
High
Generic API/secret keys
env_key = os.environ.get("DATADATA_API_KEY")
The script reads DATADATA_API_KEY from the environment and treats it as an authentication secret. This is legitimate configuration but still secret access.
Medium
Hidden file access
3. `~/.config/datadata/datadata-api-skills/config.json` 配置文件
The CLI documentation describes persistent API key storage under a hidden config path. The documented 0600 permission reduces exposure, but this is still sensitive filesystem behavior.
Medium
Hidden file access
5. API Key 自动保存到 `~/.config/datadata/datadata-api-skills/config.json`(Unix 权限 0600),后续直接使用,无需重复授权
The CLI documentation describes persistent API key storage under a hidden config path. The documented 0600 permission reduces exposure, but this is still sensitive filesystem behavior.
Medium
Python file write/append
with open(DEVICE_FLOW_STATE_FILE, "w", encoding="utf-8") as fh:
The script creates or writes Datadata config, device-flow state, or result files on disk. This is intended behavior, but it can persist sensitive data or overwrite files if misused.
Medium
Python file write/append
with open(path, "wb") as fh:
The script creates or writes Datadata config, device-flow state, or result files on disk. This is intended behavior, but it can persist sensitive data or overwrite files if misused.
Medium
Python os file operations
os.makedirs(API_KEY_CONFIG_DIR, mode=0o700, exist_ok=True)
The script creates or writes Datadata config, device-flow state, or result files on disk. This is intended behavior, but it can persist sensitive data or overwrite files if misused.
Low
Python HTTP libraries
import urllib.request
The Python CLI performs real HTTP requests to the configured Datadata base URL. This is intended behavior, but it transmits queries, metadata requests, and authenticated headers over the network.
Low
Python HTTP libraries
req = urllib.request.Request(url, data=data, headers=headers, method=method)
The Python CLI performs real HTTP requests to the configured Datadata base URL. This is intended behavior, but it transmits queries, metadata requests, and authenticated headers over the network.
Low
Python HTTP libraries · 3 occurrences
with urllib.request.urlopen(req) as resp:
The Python CLI performs real HTTP requests to the configured Datadata base URL. This is intended behavior, but it transmits queries, metadata requests, and authenticated headers over the network.
Low
Python HTTP libraries · 2 occurrences
req = urllib.request.Request(
The Python CLI performs real HTTP requests to the configured Datadata base URL. This is intended behavior, but it transmits queries, metadata requests, and authenticated headers over the network.
Low
Hardcoded URL
default=os.environ.get("DATADATA_BASE_URL", "https://www.datadata.com"),
The Python CLI performs real HTTP requests to the configured Datadata base URL. This is intended behavior, but it transmits queries, metadata requests, and authenticated headers over the network.
Low
Temp file creation
return os.path.join(tempfile.gettempdir(), f"datadata-{execution_id}{suffix}")
The result download path is built in the system temp directory by default. This is expected for exports, but it still writes data artifacts to local storage.
Low
Python environment access
default=os.environ.get("DATADATA_BASE_URL", "https://www.datadata.com"),
The script reads DATADATA_BASE_URL from the environment, which controls the remote endpoint. This is intended for configuration, but a bad value can redirect requests.
Risk Factors
⚙️ External commands (36)
agents/openai.yaml:9 agents/openai.yaml:11 agents/openai.yaml:13 agents/openai.yaml:17 agents/openai.yaml:21 agents/openai.yaml:25 SKILL.md:12 SKILL.md:14 SKILL.md:21 SKILL.md:25 SKILL.md:29 SKILL.md:49 SKILL.md:50 SKILL.md:51 SKILL.md:57 SKILL.md:58 SKILL.md:60 SKILL.md:64 SKILL.md:79 SKILL.md:83 SKILL.md:87 SKILL.md:88 SKILL.md:89 SKILL.md:106 SKILL.md:113 SKILL.md:114 SKILL.md:115 SKILL.md:116 SKILL.md:117 SKILL.md:121 SKILL.md:125 SKILL.md:126 SKILL.md:128 SKILL.md:132 SKILL.md:133 SKILL.md:136
🌐 Network access (39)
agents/openai.yaml:13 references/api.md:24 references/api.md:75 references/api.md:94 references/api.md:115 references/api.md:150 references/api.md:202 references/api.md:233 references/api.md:274 references/api.md:355 references/api.md:386 references/api.md:413 references/api.md:456 references/api.md:501 references/api.md:527 references/api.md:565 references/api.md:14 references/api.md:19 references/api.md:29 references/api.md:30 references/api.md:302 references/api.md:303 references/api.md:22 references/cli.md:43 references/cli.md:59 references/cli.md:43 references/cli.md:59 references/data-spaces.md:45 scripts/datadata_query.py:14 scripts/datadata_query.py:298 scripts/datadata_query.py:300 scripts/datadata_query.py:316 scripts/datadata_query.py:322 scripts/datadata_query.py:332 scripts/datadata_query.py:338 scripts/datadata_query.py:23 scripts/datadata_query.py:1339 SKILL.md:29 SKILL.md:58
📁 Filesystem access (19)
references/api.md:301 references/api.md:312 references/cli.md:20 references/cli.md:33 references/cli.md:37 references/cli.md:20 references/cli.md:33 references/cli.md:37 scripts/datadata_query.py:370 scripts/datadata_query.py:370 scripts/datadata_query.py:10 scripts/datadata_query.py:827 scripts/datadata_query.py:432 scripts/datadata_query.py:459 scripts/datadata_query.py:831 scripts/datadata_query.py:391 scripts/datadata_query.py:437 scripts/datadata_query.py:443 scripts/datadata_query.py:496
🔑 Env variables (130)
references/api.md:21 references/api.md:25 references/api.md:233 references/api.md:302 references/api.md:529 references/api.md:530 references/cli.md:10 references/cli.md:19 references/cli.md:42 references/cli.md:58 scripts/datadata_query.py:23 scripts/datadata_query.py:27 scripts/datadata_query.py:373 scripts/datadata_query.py:1152 scripts/datadata_query.py:402 scripts/datadata_query.py:407 scripts/datadata_query.py:1178 scripts/datadata_query.py:27 scripts/datadata_query.py:33 scripts/datadata_query.py:179 scripts/datadata_query.py:181 scripts/datadata_query.py:186 scripts/datadata_query.py:191 scripts/datadata_query.py:196 scripts/datadata_query.py:206 scripts/datadata_query.py:210 scripts/datadata_query.py:213 scripts/datadata_query.py:220 scripts/datadata_query.py:231 scripts/datadata_query.py:239 scripts/datadata_query.py:252 scripts/datadata_query.py:260 scripts/datadata_query.py:267 scripts/datadata_query.py:275 scripts/datadata_query.py:282 scripts/datadata_query.py:289 scripts/datadata_query.py:293 scripts/datadata_query.py:294 scripts/datadata_query.py:315 scripts/datadata_query.py:318 scripts/datadata_query.py:331 scripts/datadata_query.py:334 scripts/datadata_query.py:360 scripts/datadata_query.py:363 scripts/datadata_query.py:381 scripts/datadata_query.py:382 scripts/datadata_query.py:385 scripts/datadata_query.py:390 scripts/datadata_query.py:391 scripts/datadata_query.py:394 scripts/datadata_query.py:397 scripts/datadata_query.py:402 scripts/datadata_query.py:403 scripts/datadata_query.py:414 scripts/datadata_query.py:415 scripts/datadata_query.py:420 scripts/datadata_query.py:423 scripts/datadata_query.py:429 scripts/datadata_query.py:432 scripts/datadata_query.py:437 scripts/datadata_query.py:440 scripts/datadata_query.py:443 scripts/datadata_query.py:501 scripts/datadata_query.py:506 scripts/datadata_query.py:567 scripts/datadata_query.py:579 scripts/datadata_query.py:586 scripts/datadata_query.py:600 scripts/datadata_query.py:601 scripts/datadata_query.py:603 scripts/datadata_query.py:605 scripts/datadata_query.py:608 scripts/datadata_query.py:611 scripts/datadata_query.py:614 scripts/datadata_query.py:623 scripts/datadata_query.py:638 scripts/datadata_query.py:646 scripts/datadata_query.py:696 scripts/datadata_query.py:697 scripts/datadata_query.py:709 scripts/datadata_query.py:710 scripts/datadata_query.py:718 scripts/datadata_query.py:780 scripts/datadata_query.py:795 scripts/datadata_query.py:809 scripts/datadata_query.py:816 scripts/datadata_query.py:818 scripts/datadata_query.py:849 scripts/datadata_query.py:850 scripts/datadata_query.py:863 scripts/datadata_query.py:883 scripts/datadata_query.py:890 scripts/datadata_query.py:899 scripts/datadata_query.py:911 scripts/datadata_query.py:963 scripts/datadata_query.py:975 scripts/datadata_query.py:983 scripts/datadata_query.py:1000 scripts/datadata_query.py:1005 scripts/datadata_query.py:1008 scripts/datadata_query.py:1032 scripts/datadata_query.py:1047 scripts/datadata_query.py:1097 scripts/datadata_query.py:1100 scripts/datadata_query.py:1107 scripts/datadata_query.py:1126 scripts/datadata_query.py:1143 scripts/datadata_query.py:1145 scripts/datadata_query.py:1148 scripts/datadata_query.py:1149 scripts/datadata_query.py:1152 scripts/datadata_query.py:1153 scripts/datadata_query.py:1157 scripts/datadata_query.py:1162 scripts/datadata_query.py:1176 scripts/datadata_query.py:1221 scripts/datadata_query.py:1222 scripts/datadata_query.py:1224 scripts/datadata_query.py:1228 scripts/datadata_query.py:1271 scripts/datadata_query.py:1279 scripts/datadata_query.py:1310 scripts/datadata_query.py:1328 scripts/datadata_query.py:1342 scripts/datadata_query.py:1348 scripts/datadata_query.py:1349 scripts/datadata_query.py:1355 scripts/datadata_query.py:1358 scripts/datadata_query.py:1362 SKILL.md:57
Audited by: codex
Jun 29, 2026, 10:42 AM
Static command-execution and weak-crypto alerts are mostly false positives from Markdown backticks, SQL examples, and ordinary text. The real risks are broad Datadata API access, API-key persistence, remote SQL execution, data-space writes, network requests, and local result-file writes; no prompt injection or confirmed malicious intent was found.
7
Files scanned
2,698
Lines analyzed
9
Review items
3
False positives ignored
Confirmed security concerns (1)
High
Data-Space Write and Drop Capabilities
The skill supports creating tables, inserting rows, and dropping data-space tables through authenticated API calls. These are legitimate commands, but marketplace users need a clear warning because mistaken datasource selection can alter user-managed data spaces.
The API endpoints and documented workflow directly support data-space mutation. The skill includes confirmation rules, but the capability itself is high impact.
Capability review items (4)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Broad Datadata API Key Creation and Persistence
The skill guides agents through device authorization and the CLI requests a 90-day key with datasource read, scan, execute, replace-file, and data-space write permissions. The key is saved locally, which is legitimate for the tool but high impact if the agent is misused or the host is shared.
The code explicitly lists broad default permissions and writes the issued key to a config file with a 90-day lifetime. This is intended functionality, not hidden behavior, but it materially increases account exposure.
High
Remote SQL Execution Against User Datasources
The CLI sends user-provided SQL scripts and datasource bindings to the Datadata execute-adhoc endpoint. Documentation says this is read-only, but it can still expose private data or run expensive queries if used without careful confirmation.
The script field is sent directly to a remote execution API and the references confirm SQL execution is a core capability. The server may enforce read-only behavior, so the risk is high but not confirmed malicious.
Medium
Configurable Base URL Sends Credentials to Chosen Host
DATADATA_BASE_URL and --base-url can override the service endpoint, while API keys are placed in request headers. This is useful for development, but a malicious or mistaken base URL could receive Datadata credentials.
The base URL is user-configurable and request headers include the API key. The default is the legitimate Datadata domain, so this is a misuse risk rather than confirmed exfiltration.
Medium
Result Files Written to Local Filesystem
Query result artifacts are downloaded and written to a caller-provided output path or a temp-file path. This is expected behavior, but it can store sensitive query output on disk and may overwrite a selected path.
The write path is clear in the code and result data may be sensitive. There is no evidence of stealthy writes, but users should know outputs persist locally.
Static false positives ignored (3)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Low
Markdown Backticks Misclassified as Shell Execution
Most external command findings occur in SKILL.md and reference files where backticks mark inline code, command examples, SQL examples, and Markdown fences. The inspected Python script does not call shell, subprocess, eval, or os.system.
Manual review shows Markdown formatting and examples at representative flagged lines. No evidence found of shell execution in the Python entry point.
Low
Weak-Crypto and Obfuscation Alerts Appear Textual
The weak-cryptography and high-entropy alerts align with words such as API key, SQL, Chinese documentation, and example identifiers. No evidence found of encoded payloads, encrypted blobs, or custom cryptography in the reviewed files.
The files are human-readable documentation and Python source. Static entropy is plausibly inflated by non-English text and dense examples, but a full byte-level entropy review was not repeated.
Low
No Prompt Injection Attempt Found
Targeted review did not find text claiming to override system instructions, skip security review, force approval, or impersonate a higher-priority role. No evidence found of prompt injection in the inspected files.
The reviewed instruction sections contain operational rules for Datadata use, not marketplace-audit override language. The finding is framed as absence of evidence after targeted keyword and context review.
Risk Factors
⚡ Contains scripts (2)
🌐 Network access (3)
📁 Filesystem access (3)
🔑 Env variables (2)
Detected Patterns
Authenticated Network RequestsCredential File StorageCaller-Controlled Output Path Writes
Audited by: codex
May 22, 2026, 01:26 AM
This skill is a legitimate API client for the Datadata platform. All 815 static findings are false positives resulting from documentation code examples in markdown files (backtick shell commands), standard API client patterns (HTTP requests, credential storage), and heuristic entropy detection on legitimate content. The Python CLI script is well-structured, uses stdlib only, stores credentials with proper filesystem permissions (0700/0600), and connects only to the known datadata.com domain. No evidence of malicious intent, obfuscation, or data exfiltration was found.
7
Files scanned
2,698
Lines analyzed
4
Review items
7
False positives ignored
Static false positives ignored (7)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Medium
references/api.md:3references/api.md:5references/api.md:13-14references/cli.md:5-10references/data-spaces.md:3references/query-guide.md:3SKILL.md:12-14SKILL.md:21-25SKILL.md:29
External command execution in documentation examples
FALSE POSITIVE: The static analyzer detected backtick patterns in reference markdown files and SKILL.md as Ruby/shell execution. These are shell command examples (curl, CLI invocations) shown in code blocks for documentation purposes. They are not executable code within the skill itself. The actual CLI execution happens through the agent running python3 scripts/datadata_query.py as a subprocess, which is the expected operation of this skill.
Medium
agents/openai.yaml:9agents/openai.yaml:11agents/openai.yaml:13agents/openai.yaml:17agents/openai.yaml:21agents/openai.yaml:25
Ruby shell backtick patterns in agent YAML
FALSE POSITIVE: The openai.yaml agent definition includes backtick-delimited code examples demonstrating CLI usage patterns. These are instructional examples for the AI agent, not executable Ruby/shell code. The skill is designed to run datadata_query.py as a Python subprocess, which is its legitimate function.
Low
scripts/datadata_query.py:27scripts/datadata_query.py:382scripts/datadata_query.py:402-403SKILL.md:57
API credential access in legitimate API client
FALSE POSITIVE: The script reads DATADATA_API_KEY from environment variables and a local config file (~/.config/datadata/config.json). This is expected behavior for a legitimate API client tool. Credentials are stored with secure filesystem permissions (0600). The access pattern is not malicious - it is the standard way CLI tools handle authentication.
Low
scripts/datadata_query.py:14scripts/datadata_query.py:298scripts/datadata_query.py:316scripts/datadata_query.py:332
Network HTTP libraries in API client
FALSE POSITIVE: The script imports urllib.request and makes HTTP requests to api.datadata.com endpoints. This is expected behavior for an API client tool. The script connects only to a single known domain (datadata.com) for legitimate data query operations, with no evidence of data exfiltration or connections to unknown endpoints.
Low
scripts/datadata_query.py:31scripts/datadata_query.py:47-48scripts/datadata_query.py:110-112scripts/datadata_query.py:195scripts/datadata_query.py:566scripts/datadata_query.py:622-627
Weak cryptographic algorithm detection on datetime import
FALSE POSITIVE: The static analyzer flagged import datetime as a weak cryptographic algorithm. The datetime module is used for timestamp calculations (API key expiry checks, device flow state expiration). No actual cryptographic operations are performed. This is a standard library import with no security implications.
Low
scripts/datadata_query.py:370scripts/datadata_query.py:391scripts/datadata_query.py:432scripts/datadata_query.py:437scripts/datadata_query.py:443references/cli.md:20references/cli.md:33references/cli.md:37
Hidden file access for credential storage
FALSE POSITIVE: The script stores API keys in ~/.config/datadata/config.json with proper Unix permissions (0700 for directory, 0600 for file). This is the standard and recommended practice for CLI tools to persist credentials. The access pattern is not suspicious or malicious.
Low
scripts/datadata_query.py:129-130references/cli.md:55references/cli.md:63-64references/cli.md:75SKILL.md:25
System reconnaissance detection on whoami API call
FALSE POSITIVE: The script includes a whoami command that calls a Datadata API endpoint (/api/v1/api-keys/whoami) to verify API key validity and inspect permissions. This is not Unix system reconnaissance. The static analyzer confused the API endpoint name with the Unix whoami command.
Risk Factors
⚙️ External commands (28)
agents/openai.yaml:9 agents/openai.yaml:11 agents/openai.yaml:13 agents/openai.yaml:17 agents/openai.yaml:25 references/api.md:3 references/api.md:5 references/api.md:13-14 references/cli.md:5-10 references/data-spaces.md:3 references/query-guide.md:3 SKILL.md:12 SKILL.md:14 SKILL.md:21 SKILL.md:25 SKILL.md:29 SKILL.md:49-51 SKILL.md:57-60 SKILL.md:64 SKILL.md:79 SKILL.md:87-89 SKILL.md:106 SKILL.md:113-117 SKILL.md:121 SKILL.md:125-126 SKILL.md:128 SKILL.md:132-133 SKILL.md:136
🌐 Network access (16)
agents/openai.yaml:13 scripts/datadata_query.py:14 scripts/datadata_query.py:298-300 scripts/datadata_query.py:316-322 scripts/datadata_query.py:332-338 scripts/datadata_query.py:23 scripts/datadata_query.py:1339 references/api.md:3 references/api.md:22 references/api.md:24 references/api.md:75 references/cli.md:43 references/cli.md:59 references/data-spaces.md:45 SKILL.md:29 SKILL.md:58
📁 Filesystem access (13)
scripts/datadata_query.py:10 scripts/datadata_query.py:370 scripts/datadata_query.py:391 scripts/datadata_query.py:432 scripts/datadata_query.py:437 scripts/datadata_query.py:443 scripts/datadata_query.py:459 scripts/datadata_query.py:496 scripts/datadata_query.py:827 scripts/datadata_query.py:831 references/cli.md:20 references/cli.md:33 references/cli.md:37
🔑 Env variables (19)
scripts/datadata_query.py:23 scripts/datadata_query.py:27 scripts/datadata_query.py:33 scripts/datadata_query.py:373 scripts/datadata_query.py:382 scripts/datadata_query.py:402-403 scripts/datadata_query.py:407 scripts/datadata_query.py:1152 scripts/datadata_query.py:1178 references/api.md:21 references/api.md:25 references/api.md:233 references/api.md:302 references/api.md:529-530 references/cli.md:10 references/cli.md:19 references/cli.md:42 references/cli.md:58 SKILL.md:57
Audited by: claude