Security audit

Google Super

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Google account integration that can access and change sensitive Google data after the user connects OAuth.

Install only if you want ClawLink to broker broad access across your Google account. Review the Google OAuth consent screen carefully, avoid granting unnecessary scopes, use write/delete/Ads tools only with explicit intent, and revoke the ClawLink connection when you no longer need it.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The skill description is extremely broad and matches many common productivity requests such as email, calendar, documents, spreadsheets, files, analytics, and ads. That increases the chance the skill is invoked in situations where the user did not intend to grant or use a connection with very broad Google access, creating over-collection and unnecessary exposure of sensitive workspace data.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The markdown explains connection and OAuth but does not present an upfront, prominent warning that connecting this single integration can expose Gmail, Drive, Calendar, Docs, Sheets, Photos, Analytics, Ads, and other Google data through one bundled authorization. Because the integration aggregates many sensitive services, weak disclosure materially increases privacy and consent risk.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.