scraping-google-search-results

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:22 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward Apify-based Google search scraping helper, with a credential-handling caveat users should understand before use.

Install only if you are comfortable sending search terms and related run data to Apify. Use a scoped Apify token where possible, avoid sensitive or regulated queries, and prefer safer authentication methods over token-in-URL curl examples.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:84

Finding

Apify API Token Exposed in URL Query Strings

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 84–99
Vulnerability Type: API credential exposure through URL query parameters
Risk Level: Medium

The REST fallback instructions place APIFY_TOKEN directly in multiple request URLs:

bash

**REST API fallback:**
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~google-search-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"queries": ["query1", "query2"], "maxPagesPerQuery": 1}'

Save id as RUN_ID. Poll until status = SUCCEEDED:

bash

curl "https://api.apify.com/v2/actor-runs/$RUN_ID?token=$APIFY_TOKEN" | grep '"status"'

Fetch results:

bash

curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN&format=json"

Technical Analysis

Authentication with Apify is necessary for the Skill's declared functionality, and the requests target the expected api.apify.com service. However, transmitting an API token as a URL query parameter is an insecure credential-handling practice.

After shell expansion, the token becomes part of the URL supplied to curl. URLs are commonly captured by process inspection, HTTP client diagnostics, reverse proxies, gateway access logs, monitoring systems, error reports, and copied terminal output. Although HTTPS protects the URL while it is in transit, it does not prevent disclosure through endpoint or infrastructure logging.

The network communication itself does not exceed the minimum privileges required to invoke the hosted scraper. The vulnerability arises from the credential transport mechanism rather than from an unauthorized destination. User-supplied search terms are also intentionally disclosed to Apify as part of the advertised scraping workflow.

Attack Path

1. A user exports a valid APIFY_TOKEN and executes the documented REST fallback command.
2. The shell expands $APIFY_TOKEN, placing its value ...[truncated 837 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove token=$APIFY_TOKEN from every URL.

2. Use Apify's supported authorization-header mechanism instead of query-string authentication, for example:

   bash

   curl -X POST \
     "https://api.apify.com/v2/acts/apidojo~google-search-scraper/runs" \
     -H "Authorization: Bearer $APIFY_TOKEN" \
     -H "Content-Type: application/json" \
     -d '{"queries": ["query1", "query2"], "maxPagesPerQuery": 1}'
   

3. Apply the same header-based authentication to polling and dataset-download requests.

4. Prefer a credential-aware client or protected configuration mechanism that avoids exposing the token in command-line process arguments.

5. Ensure HTTP debugging, verbose output, and request logging redact authorization data.

6. Use a least-privilege Apify token where supported, and rotate any token suspected of having appeared in process captures, request logs, or diagnostic artifacts.

7. Explicitly inform users that submitted search queries are transmitted to Apify for processing.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill sends user-provided search queries and related parameters to Apify, a third-party service, but the documentation does not clearly warn users that their input leaves the local environment. This creates a privacy and data-handling risk, especially if users submit sensitive, proprietary, or regulated search terms under the assumption the action is local.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This command posts user queries to Apify's external API, which is an intentional data egress path. In context, the transmission is necessary for the skill to function, but it is still security-relevant because user input and potentially sensitive search terms are sent to a third party and the example also places the API token in the URL, which increases exposure through logs and shell history.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

REST API fallback:

bash

curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~google-search-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"queries": ["query1", "query2"], "maxPagesPerQuery": 1}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

REST API fallback:

bash

curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~google-search-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"queries": ["query1", "query2"], "maxPagesPerQuery": 1}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 86% confidence

Finding

Polling the actor-run endpoint sends the run identifier and API token to Apify, continuing the external data flow and credential exposure pattern. While expected for this integration, the use of token query parameters can leak credentials via terminal history, process inspection, proxy logs, or monitoring systems.

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

Save id as RUN_ID. Poll until status = SUCCEEDED:

bash

curl "https://api.apify.com/v2/actor-runs/$RUN_ID?token=$APIFY_TOKEN" | grep '"status"'

Fetch results:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

Fetching dataset results from Apify is another intentional external transmission point and may retrieve and expose scraped data through a third-party service path. If the collected queries or results are sensitive, this expands the privacy and compliance risk, and again the token is embedded in the URL.

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

Fetch results:

bash

curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN&format=json"

Step 3: Handle Edge Cases

Static analysis

No suspicious patterns detected.