Google Search Console Analytics

• Outcome: Review
• Latest audit: Sep 15, 2026 · 2:17 AM UTC
• Version: 1.0.0

Overview

The skill is for Google Search Console reporting, but it delegates credentialed work to an unbundled executable at an absolute path, so users cannot verify what will run from the reviewed package alone.

Install only if you trust and can independently verify the executable at /root/.openclaw/skills/gsc-search/gsc-search and the Google credentials it uses. Prefer a narrowly scoped service account, protected file permissions, and clearer triggers limited to akku-alle.de Search Console requests.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T07 · Tool Hijacking and Spoofing

Warning

• Location: SKILL.md:3

Finding

Execution of an Unreviewed External Tool with Credential Access

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 3–20
Vulnerability Type: Trusting an external executable outside the audited skill package
Risk Level: Medium

Relevant Code:

markdown

description: "Ruft Google Search Console Daten für akku-alle.de ab - Klicks, Impressionen, CTR, Rankings und Top-Keywords. Nutze das shell Tool um /root/.openclaw/skills/gsc-search/gsc-search auszuführen."
metadata: {"requires":{"env":["GOOGLE_APPLICATION_CREDENTIALS"]},"emoji":"🔍","always":true}
user-invocable: true
---

# Google Search Console Skill

Ruft Search Console Daten für akku-alle.de ab.

## Aufruf via Shell Tool

**WICHTIG**: Rufe dieses Skill mit dem `shell` Tool auf:

```bash
/root/.openclaw/skills/gsc-search/gsc-search

text

### Technical Analysis

The skill instructs the agent to invoke `/root/.openclaw/skills/gsc-search/gsc-search`, an absolute-path executable that is not included in the audited project. Consequently, the executable's implementation, integrity, ownership, and behavior cannot be verified from this package.

The skill also declares a requirement for `GOOGLE_APPLICATION_CREDENTIALS` and is configured with `"always": true`. If the external executable is replaced, modified, or resolved from an inadequately protected location, an attacker-controlled program could run under the agent's identity and potentially access the credential configuration available to the process.

This is classified as tool hijacking because a legitimate-looking skill invocation delegates its effective behavior to an unaudited local tool. The reviewed `SKILL.md` does not itself prove that the referenced executable is malicious; the risk arises from the unverified external trust boundary.

### Attack Path

1. An attacker who can modify `/root/.openclaw/skills/gsc-search/gsc-search` replaces it with a malicious executable or script.
2. The skill is loaded automatically or selected in response to a Searc
...[truncated 1277 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the executable and its source code within the reviewed skill package so its behavior can be audited and versioned with the instructions.
2. Verify the executable before every invocation using a pinned cryptographic hash, signed artifact, or trusted package manifest.
3. Ensure the executable and every parent directory are owned by a trusted administrator and are not writable by unprivileged users or unrelated services.
4. Run the executable in a sandbox with a read-only filesystem, restricted network access, and only the minimum required operating-system permissions.
5. Provide Google credentials only to the subprocess that requires them rather than exposing them broadly in the agent environment.
6. Use a dedicated service account with narrowly scoped IAM permissions and rotate its credentials regularly.
7. Prefer short-lived workload identity credentials over persistent credential files where supported.
8. Remove "always": true unless automatic loading is operationally necessary, reducing unnecessary exposure of the execution instruction.
9. Validate and constrain all arguments passed to the executable, including the documented queries argument.
10. Log executable integrity checks, invocations, and credential-access failures without recording credential contents.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The natural-language content throughout the skill is written exclusively in German and provides no indication that users may choose another language or that the skill is intentionally limited to a German-only audience for policy or compliance reasons. This can violate language or locale policy when a skill implicitly forces one language without explicit opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger phrase "SEO Statistiken" is broad and underspecified, so the agent may invoke this skill for generic SEO-related requests that do not specifically ask for Google Search Console data for akku-alle.de. This can cause unintended access to site-specific analytics and lead to scope overreach or confusing behavior, especially because the skill is marked always: true and is user-invocable.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.