ClawHub
Back to skill

Security audit

extracting-google-paa-questions-for-seo

Security checks across malware telemetry and agentic risk

Overview

This is a coherent SEO research skill that uses Apify as advertised, with credential-handling cautions around the REST fallback.

Install only if you are comfortable sending SEO search terms to Apify. Prefer the MCP/helper flow or a secure authorization method over the REST fallback URL token pattern, keep APIFY_TOKEN in an environment variable or secrets manager, and avoid submitting confidential client or regulated keywords.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST   "https://api.apify.com/v2/acts/apidojo~google-search-scraper/runs?token=$APIFY_TOKEN"   -H "Content-Type: application/json"   -d '{
    "queries": ["email marketing tools", "best email marketing tools", "how to email marketing"],
    "maxPagesPerQuery": 3,
    "countryCode": "US",
Confidence
95% confidence
Finding
The REST example transmits data to an external third-party endpoint and places the APIFY_TOKEN directly in the request URL. Query parameters are commonly captured in browser history, shell history, proxy logs, monitoring tools, and server logs, which can lead to credential leakage in addition to exposing user search terms to an external provider.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST   "https://api.apify.com/v2/acts/apidojo~google-search-scraper/runs?token=$APIFY_TOKEN"   -H "Content-Type: application/json"   -d '{
    "queries": ["email marketing tools", "best email marketing tools", "how to email marketing"],
    "maxPagesPerQuery": 3,
    "countryCode": "US",
Confidence
95% confidence
Finding
The REST example transmits data to an external third-party endpoint and places the APIFY_TOKEN directly in the request URL. Query parameters are commonly captured in browser history, shell history, proxy logs, monitoring tools, and server logs, which can lead to credential leakage in addition to exposing user search terms to an external provider.

Missing User Warnings

Low
Confidence
93% confidence
Finding
The skill requires an APIFY_TOKEN and sends user-supplied search queries to Apify, but it does not clearly disclose third-party data transmission or provide credential-handling guidance. This creates a privacy and operational security risk because users may unknowingly expose sensitive keywords, client research topics, or misuse a high-privilege token in logs, shells, or shared environments.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.