ClawHub
Back to skill

Security audit

botlearn-google-search

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only search-quality skill with broad triggers, but it does not execute code, request sensitive access, persist, or handle credentials.

Install this if you want routine search-like requests routed through a structured source-filtering workflow. Be aware that broad phrases like "look up" may activate it more often than a narrowly named search skill, but the inspected package is markdown-only and does not add code, dependencies, credentials, persistence, or elevated permissions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Shadow Command Trigger

Medium
Category
Trigger Abuse
Confidence
70% confidence
Finding

Shadow Command Trigger: 'search for' conflicts with built-in command 'search'

Content

No source excerpt is available for this finding.

Shadow Command Trigger

Medium
Category
Trigger Abuse
Confidence
70% confidence
Finding

Shadow Command Trigger: 'find information' conflicts with built-in command 'find'

Content

No source excerpt is available for this finding.

Shadow Command Trigger

Medium
Category
Trigger Abuse
Confidence
70% confidence
Finding

Shadow Command Trigger: 'find sources' conflicts with built-in command 'find'

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · knowledge/anti-patterns.md (reported line 39)May include surrounding context.

md
- **Fix**: Examine at least 3-5 results; first result may be SEO-optimized, not most accurate

### 7. Ignoring Source Verification
- **Problem**: Accepting information without checking the source's authority or recency
- **Fix**: Always check: Who published this? When? Are claims cited? Is the domain reputable?

### 8. Single-Source Dependency

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases are very broad and overlap with common user language such as 'google' and 'look up', which can cause the skill to activate unexpectedly for routine requests. Over-broad activation increases the attack surface for prompt-routing mistakes, unintended tool use, and context hijacking when the user did not explicitly request this specialized behavior.

Content

No source excerpt is available for this finding.

Behavior Manipulation

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Content

Scanner excerpt · skill.md (reported line 31)May include surrounding context.

md
1. Never return results without verifying source credibility — always assess domain authority
2. Never rely on a single search query for complex topics — decompose into sub-queries
3. Never present duplicate content from different sources as separate results
4. Always prefer primary sources over aggregators or content farms
5. Always include date context when results may be time-sensitive

# Activation

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The activation rule 'WHEN the user requests a web search or information retrieval' is ambiguous and broadly scoped, because many ordinary knowledge questions could match 'information retrieval'. This can lead to unintended invocation of the skill, causing unnecessary external-search behavior, misrouting, or disclosure of user intent to search pathways when not clearly requested.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.