finding-content-gaps-from-google-serp

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:19 AM UTC
• Version: 1.0.0

Overview

The skill is coherent and not malicious, but its documented REST fallback puts an Apify API token in a URL where it can be logged or exposed.

Review this skill before installing if you plan to use the REST fallback. Prefer Apify MCP or a command that sends the token in an Authorization header, use a narrowly scoped Apify token, avoid shell/debug logging around credentials, and choose output file paths deliberately when saving SERP results.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:91

Finding

API Token Exposed in URL Query String

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 91
Vulnerability Type: Sensitive credential exposure through a URL query parameter
Risk Level: Medium

Vulnerable Code

bash

curl -X POST   "https://api.apify.com/v2/acts/apidojo~google-search-scraper/runs?token=$APIFY_TOKEN"   -H "Content-Type: application/json"   -d '{"queries": ["[KEYWORD_1]", "[KEYWORD_2]"], "maxPagesPerQuery": 1}'

Technical Analysis

The documented REST fallback places APIFY_TOKEN directly in the request URL. Although HTTPS protects the request while it is in transit to the legitimate Apify endpoint, URL query strings are commonly captured by shell tracing, command history, HTTP client diagnostics, proxies, access logs, monitoring systems, and error-reporting platforms.

Network access to Apify and authentication with an Apify token are necessary for the Skill's declared Google SERP analysis. However, exposing the credential in a query string is not the minimum safe authentication mechanism and unnecessarily expands the number of systems that may retain it.

No evidence indicates intentional credential exfiltration: the destination is the declared service, and the audit found no malicious instruction hijacking, persistence, obfuscation, or remote payload execution.

Attack Path

1. A user follows the documented REST fallback command with APIFY_TOKEN set.
2. The shell expands $APIFY_TOKEN into the complete request URL.
3. The resulting URL may be retained by shell tracing, process instrumentation, proxy logs, endpoint monitoring, or HTTP diagnostics.
4. An attacker or unauthorized operator with access to one of those records obtains the token.
5. The attacker reuses the token against Apify APIs within the permissions assigned to it.

Impact Assessment

A leaked token may permit unauthorized use of the victim's Apify account resources within that token's scope. Potential consequences include consuming paid execution quota, starting actor runs, ...[truncated 291 chars]

Remediation

View remediation

Remediation Suggestions

1. Use Apify's supported authorization-header mechanism rather than a URL query parameter, for example:

   bash

   curl -X POST \
     "https://api.apify.com/v2/acts/apidojo~google-search-scraper/runs" \
     -H "Authorization: Bearer $APIFY_TOKEN" \
     -H "Content-Type: application/json" \
     -d '{"queries":["[KEYWORD_1]","[KEYWORD_2]"],"maxPagesPerQuery":1}'
   

2. Verify the exact authentication-header syntax against current Apify documentation before publishing the replacement command.

3. Use a narrowly scoped token granting only the permissions required to run the designated actor and read its results.

4. Avoid verbose shell tracing or HTTP debugging when credentials are present, and ensure logs redact authorization values.

5. If the token is loaded from .env, exclude that file from version control and restrict its filesystem permissions.

6. Rotate any token that may already have appeared in URL, proxy, monitoring, or diagnostic logs.

7. Update the documentation to warn users not to paste tokens directly into commands or commit them to project files.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest description lists many natural-language trigger phrasings such as "identify topics that are poorly covered" and "analyze what is missing," but it does not define clear constraints or exclusion conditions for when the skill should or should not activate. These phrases are broad enough to overlap with general SEO or content-strategy conversations, increasing the risk of unintended invocation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

REST API fallback:

bash

curl -X POST   "https://api.apify.com/v2/acts/apidojo~google-search-scraper/runs?token=$APIFY_TOKEN"   -H "Content-Type: application/json"   -d '{"queries": ["[KEYWORD_1]", "[KEYWORD_2]"], "maxPagesPerQuery": 1}'

Step 2: Score SERP Quality

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

REST API fallback:

bash

curl -X POST   "https://api.apify.com/v2/acts/apidojo~google-search-scraper/runs?token=$APIFY_TOKEN"   -H "Content-Type: application/json"   -d '{"queries": ["[KEYWORD_1]", "[KEYWORD_2]"], "maxPagesPerQuery": 1}'

Step 2: Score SERP Quality

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The markdown instructs users to run commands that automatically save results to local files and requires use of the APIFY_TOKEN environment variable, but it does not explicitly warn that the skill may write files locally and transmit queries to a third-party service. Because these behaviors can affect user data handling and privacy, the skill description should disclose them clearly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.