ClawHub
Back to skill

Security audit

tracking-google-serp-rankings

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward SEO helper that uses Apify's Google Search scraper, with external API use and token requirements that fit its stated purpose.

Install this only if you are comfortable using Apify/apidojo for Google SERP scraping. Keep APIFY_TOKEN in environment or approved secret storage, avoid putting sensitive client or unreleased strategy terms into queries unless permitted, and do not use customMapFunction code from untrusted sources.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill directs users to send keywords and related search inputs to Apify/Apidojo but does not clearly disclose that this data will be transmitted to a third-party service. This creates a privacy and data-governance risk, especially if users submit sensitive business terms, client data, or unreleased campaign information under the assumption processing is local.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The documented `customMapFunction` allows arbitrary JavaScript to be supplied for transforming output, which exceeds the skill’s stated purpose of ranking retrieval and reporting. In an agent/tooling context, exposing user-provided code execution materially increases risk of code injection, unsafe data handling, or unexpected side effects if the function is ever executed by supporting infrastructure.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~google-search-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
85% confidence
Finding
The REST fallback explicitly transmits user-supplied queries and the `APIFY_TOKEN` to an external API endpoint. External transmission is expected for this skill’s function, but it is still security-relevant because it can expose sensitive search terms and relies on proper token handling and trusted third-party processing.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~google-search-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "queries": ["[keyword1]", "[keyword2]"],
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.