ClawHub
Back to skill

Security audit

finding-industry-event-coverage-google

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Apify-based Google event-coverage search helper, with expected third-party API and token use but no hidden execution, persistence, or destructive behavior.

Install only if you are comfortable sending event names, search terms, and resulting search data to Apify. Prefer the provided MCP or runner path when available, avoid putting API tokens in shell history or shared logs, and review any saved CSV/JSON outputs before sharing them.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The manifest description lists many natural-language requests such as 'research what was announced at a conference' and 'find news and recaps of an industry event' as triggers, but it does not define exact trigger phrases, scope limits, or negative examples. These phrases overlap with common research requests and could cause the skill to activate in situations beyond the intended Google event-coverage use case.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~google-search-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"searchTerms": ["[EVENT_NAME] 2026", "[EVENT_NAME] recap", "[EVENT_NAME] announcements", "[EVENT_NAME] highlights"], "maxItems": 100}'
Confidence
89% confidence
Finding
This instruction sends user-provided search terms and an authentication token to an external third-party service (Apify). External transmission is security-relevant because prompts, search terms, and metadata may contain sensitive business research topics, and embedding the token in the URL increases the chance of leakage via shell history, logs, proxies, or monitoring systems.

External Transmission

Medium
Category
Data Exfiltration
Content
Wait for `SUCCEEDED`. Fetch dataset:
```bash
curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN"
```

### Step 3: Classify Results
Confidence
87% confidence
Finding
Fetching the dataset from Apify transmits and retrieves potentially sensitive search-result data through a third-party service, again using the API token in the URL. This creates confidentiality and credential-handling risks, especially for competitive-intelligence use cases where event targets, search queries, and collected results may be sensitive.

External Transmission

Medium
Category
Data Exfiltration
Content
Wait for `SUCCEEDED`. Fetch dataset:
```bash
curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN"
```

### Step 3: Classify Results
Confidence
87% confidence
Finding
Fetching the dataset from Apify transmits and retrieves potentially sensitive search-result data through a third-party service, again using the API token in the URL. This creates confidentiality and credential-handling risks, especially for competitive-intelligence use cases where event targets, search queries, and collected results may be sensitive.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.