Security audit

Google Search Console

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Google Search Console integration, but it asks users to install and allowlist an unpinned external plugin that then relies on a live tool catalog for sensitive account operations.

Review the ClawLink plugin before installing, confirm you trust ClawLink to hold and use Google Search Console OAuth access, and only proceed if you are comfortable with a persistent allowlisted plugin whose live tool catalog may change. Be especially careful with site deletion, site addition, and sitemap submission actions, and require clear previews before approving writes.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:48
Finding: Unpinned Third-Party Plugin Installation and Allowlisting
Content: View full analysis
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Warning

Location: SKILL.md:219
Finding: Externally Controlled Tool Catalog Treated as Authoritative
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep