ClawHub
Back to skill

Security audit

Open GA4

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed read-only Google Analytics helper with sensible privacy controls and no evidence of hidden exfiltration or persistence.

Install only with a dedicated Google service account granted Viewer on the specific GA4 properties you want queried. Avoid broad personal gcloud credentials unless you understand that the skill can read any Analytics property that identity can read, and enable GA4_AUDIT_LOG only if you want a local record of report requests.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (92)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
75% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · CHANGELOG.md (reported line 46)May include surrounding context.

md
message cannot be sanitised into uselessness instead.

Deliberately not changed: the remaining review findings ask for the ambient
gcloud credential fallback to be removed, for setup diagnostics to stop being
agent-driven, for property enumeration to be dropped, and for network egress to
be declared in a manifest field that OpenClaw's frontmatter does not have. The
first three are the features, not accidents, and the fourth cannot be expressed.

Cloud Metadata Access

High
Category
Server-Side Request Forgery
Confidence
60% confidence
Finding

Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.

Content

Scanner excerpt · CONTRIBUTING.md (reported line 218)May include surrounding context.

The easiest check is the skill itself: run fields with the field you intend to use and confirm the exact apiName comes back.

For the receipt to paste into the pull request, read the metadata endpoint directly:

bash
curl -s -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · PRIVACY.md (reported line 317)May include surrounding context.

md
Keeping them out of the command line stops a page title from reaching them, because
  a value in a report cannot become a flag. It does not stop whoever controls the
  environment the skill runs in, and in an agent setup that is not only the person at
  the keyboard: an agent that can edit its own configuration or export a variable
  before invoking the skill is in that set too. What the skill can do about it, and
  does, is refuse to hide it: with redaction off, every report carries a caveat saying
  so and `doctor --json` reports it in `warnings`.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · CHANGELOG.md (reported line 191)May include surrounding context.

md
path may be a mis-pasted key.
- The private key never leaves the process. `node:crypto` `createSign("RSA-SHA256")`
  signs the OAuth assertion locally; the signature goes to Google, the key does not.
- Access tokens live in a variable for their one-hour lifetime and die with the
  process. No token file. A cached Google token on disk is a credential at rest that
  you never agreed to.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · PRIVACY.md (reported line 236)May include surrounding context.

md
path may be a mis-pasted key.
- The private key never leaves the process. `node:crypto` `createSign("RSA-SHA256")`
  signs the OAuth assertion locally; the signature goes to Google, the key does not.
- Access tokens live in a variable for their one-hour lifetime and die with the
  process. No token file. A cached Google token on disk is a credential at rest that
  you never agreed to.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY.md (reported line 85)May include surrounding context.

md
path may be a mis-pasted key.
- The private key never leaves the process. `node:crypto` `createSign("RSA-SHA256")`
  signs the OAuth assertion locally; the signature goes to Google, the key does not.
- Access tokens live in a variable for their one-hour lifetime and die with the
  process. No token file. A cached Google token on disk is a credential at rest that
  you never agreed to.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY.md (reported line 250)May include surrounding context.

md
| Userinfo smuggling the real host | `https://analyticsdata.googleapis.com@evil.example.com/x` |
| Non-default port on an allowed host | `https://analyticsdata.googleapis.com:8443/x` |
| Plain HTTP | `http://analyticsdata.googleapis.com/v1beta/x` |
| Non-HTTPS scheme | `file:///etc/passwd` |
| Unparseable input | `not-a-url` |

One test asserts the refusal happens **before** `fetch` is called at all, not after.

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

The credential resolution order shows automatic access to local credential material, regardless of whether the token comes from a dedicated GA4 key or a broader credentials file. In an agent context, any automatic discovery of ambient credentials is security-sensitive because it can silently expand what the agent can access.

Content

Scanner excerpt · SETUP.md (reported line 290)May include surrounding context.

md
| 1 | `GA4_CREDENTIALS`, when it starts with `{`: the key's contents, read directly |
| 2 | `GA4_CREDENTIALS`, otherwise: the file at that path |
| 3 | `GOOGLE_APPLICATION_CREDENTIALS`: Google's standard variable, so an existing gcloud or migrated setup keeps working |
| 4 | `~/.config/gcloud/application_default_credentials.json`: whatever `gcloud auth application-default login` last wrote |

Two consequences worth knowing.

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

The credential resolution order shows automatic access to local credential material, regardless of whether the token comes from a dedicated GA4 key or a broader credentials file. In an agent context, any automatic discovery of ambient credentials is security-sensitive because it can silently expand what the agent can access.

Content

Scanner excerpt · SETUP.md (reported line 290)May include surrounding context.

md
| 1 | `GA4_CREDENTIALS`, when it starts with `{`: the key's contents, read directly |
| 2 | `GA4_CREDENTIALS`, otherwise: the file at that path |
| 3 | `GOOGLE_APPLICATION_CREDENTIALS`: Google's standard variable, so an existing gcloud or migrated setup keeps working |
| 4 | `~/.config/gcloud/application_default_credentials.json`: whatever `gcloud auth application-default login` last wrote |

Two consequences worth knowing.

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

The credential resolution order shows automatic access to local credential material, regardless of whether the token comes from a dedicated GA4 key or a broader credentials file. In an agent context, any automatic discovery of ambient credentials is security-sensitive because it can silently expand what the agent can access.

Content

Scanner excerpt · SETUP.md (reported line 290)May include surrounding context.

md
| 1 | `GA4_CREDENTIALS`, when it starts with `{`: the key's contents, read directly |
| 2 | `GA4_CREDENTIALS`, otherwise: the file at that path |
| 3 | `GOOGLE_APPLICATION_CREDENTIALS`: Google's standard variable, so an existing gcloud or migrated setup keeps working |
| 4 | `~/.config/gcloud/application_default_credentials.json`: whatever `gcloud auth application-default login` last wrote |

Two consequences worth knowing.

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

The developer alternative relies on generic local credentials rather than a narrowly scoped service account, which conflicts with least privilege. If the skill is compromised or behaves unexpectedly, the impact is amplified because the active identity may have broad organization-wide Analytics access.

Content

Scanner excerpt · SETUP.md (reported line 386)May include surrounding context.

If you already have the gcloud CLI and your own Google account has access to the property, you can skip the service account entirely. The skill reads ~/.config/gcloud/application_default_credentials.json as its last credential source.

bash
gcloud auth application-default login \

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

The developer alternative relies on generic local credentials rather than a narrowly scoped service account, which conflicts with least privilege. If the skill is compromised or behaves unexpectedly, the impact is amplified because the active identity may have broad organization-wide Analytics access.

Content

Scanner excerpt · SETUP.md (reported line 386)May include surrounding context.

If you already have the gcloud CLI and your own Google account has access to the property, you can skip the service account entirely. The skill reads ~/.config/gcloud/application_default_credentials.json as its last credential source.

bash
gcloud auth application-default login \

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

The developer alternative relies on generic local credentials rather than a narrowly scoped service account, which conflicts with least privilege. If the skill is compromised or behaves unexpectedly, the impact is amplified because the active identity may have broad organization-wide Analytics access.

Content

Scanner excerpt · SETUP.md (reported line 386)May include surrounding context.

If you already have the gcloud CLI and your own Google account has access to the property, you can skip the service account entirely. The skill reads ~/.config/gcloud/application_default_credentials.json as its last credential source.

bash
gcloud auth application-default login \

Credential Access

High
Category
Privilege Escalation
Confidence
85% confidence
Finding

Referring to a generic credentials file and instructing edits within it indicates the skill's integration with shared local auth state rather than isolated secrets. This is risky because cross-tool credential sharing can cause unintended access inheritance and harder-to-audit behavior.

Content

Scanner excerpt · SETUP.md (reported line 406)May include surrounding context.

md
out, the login still works, but gcloud prints a warning that it cannot set a quota project,
  and later calls can fail with a confusing "API not enabled" or quota error. You can either
  include the scope as above, or omit it and add the line `"quota_project_id":
  "openclaw-ga4-123456"` to `~/.config/gcloud/application_default_credentials.json` by hand.
- **The quota project must have the Data API enabled**: step 2a still applies. The quota
  project is the project whose quota and API enablement your requests are billed against.
  This is the trap: your personal account may have perfectly good Analytics access while the

Credential Access

High
Category
Privilege Escalation
Confidence
85% confidence
Finding

Referring to a generic credentials file and instructing edits within it indicates the skill's integration with shared local auth state rather than isolated secrets. This is risky because cross-tool credential sharing can cause unintended access inheritance and harder-to-audit behavior.

Content

Scanner excerpt · SETUP.md (reported line 406)May include surrounding context.

md
out, the login still works, but gcloud prints a warning that it cannot set a quota project,
  and later calls can fail with a confusing "API not enabled" or quota error. You can either
  include the scope as above, or omit it and add the line `"quota_project_id":
  "openclaw-ga4-123456"` to `~/.config/gcloud/application_default_credentials.json` by hand.
- **The quota project must have the Data API enabled**: step 2a still applies. The quota
  project is the project whose quota and API enablement your requests are billed against.
  This is the trap: your personal account may have perfectly good Analytics access while the

Credential Access

High
Category
Privilege Escalation
Confidence
85% confidence
Finding

Referring to a generic credentials file and instructing edits within it indicates the skill's integration with shared local auth state rather than isolated secrets. This is risky because cross-tool credential sharing can cause unintended access inheritance and harder-to-audit behavior.

Content

Scanner excerpt · SETUP.md (reported line 406)May include surrounding context.

md
out, the login still works, but gcloud prints a warning that it cannot set a quota project,
  and later calls can fail with a confusing "API not enabled" or quota error. You can either
  include the scope as above, or omit it and add the line `"quota_project_id":
  "openclaw-ga4-123456"` to `~/.config/gcloud/application_default_credentials.json` by hand.
- **The quota project must have the Data API enabled**: step 2a still applies. The quota
  project is the project whose quota and API enablement your requests are billed against.
  This is the trap: your personal account may have perfectly good Analytics access while the

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The short description says the skill is read-only and returns analytics rows, but the detailed content also allows optional local persistence of request metadata via GA4_AUDIT_LOG. Even though the body discloses it, the top-level description omits a disk-write behavior that can affect privacy and local data handling expectations.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The short description says the skill is read-only and returns analytics rows, but the detailed content also allows optional local persistence of request metadata via GA4_AUDIT_LOG. Even though the body discloses it, the top-level description omits a disk-write behavior that can affect privacy and local data handling expectations.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The short description says the skill is read-only and returns analytics rows, but the detailed content also allows optional local persistence of request metadata via GA4_AUDIT_LOG. Even though the body discloses it, the top-level description omits a disk-write behavior that can affect privacy and local data handling expectations.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The short description says the skill is read-only and returns analytics rows, but the detailed content also allows optional local persistence of request metadata via GA4_AUDIT_LOG. Even though the body discloses it, the top-level description omits a disk-write behavior that can affect privacy and local data handling expectations.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The short description says the skill is read-only and returns analytics rows, but the detailed content also allows optional local persistence of request metadata via GA4_AUDIT_LOG. Even though the body discloses it, the top-level description omits a disk-write behavior that can affect privacy and local data handling expectations.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The short description says the skill is read-only and returns analytics rows, but the detailed content also allows optional local persistence of request metadata via GA4_AUDIT_LOG. Even though the body discloses it, the top-level description omits a disk-write behavior that can affect privacy and local data handling expectations.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding

The short description says the skill is read-only and returns analytics rows, but the detailed content also allows optional local persistence of request metadata via GA4_AUDIT_LOG. Even though the body discloses it, the top-level description omits a disk-write behavior that can affect privacy and local data handling expectations.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The short description says the skill is read-only and returns analytics rows, but the detailed content also allows optional local persistence of request metadata via GA4_AUDIT_LOG. Even though the body discloses it, the top-level description omits a disk-write behavior that can affect privacy and local data handling expectations.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The short description says the skill is read-only and returns analytics rows, but the detailed content also allows optional local persistence of request metadata via GA4_AUDIT_LOG. Even though the body discloses it, the top-level description omits a disk-write behavior that can affect privacy and local data handling expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.