ClawHub
Back to skill

Security audit

Search Console Report

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate SEO reporting purpose, but it handles Google service-account credentials and writes local artifacts with weaker scoping than users should accept without review.

Review before installing. Use only a Google-generated service-account key with restricted Search Console access, prefer code that pins the OAuth token endpoint to Google's official URL, install dependencies from reviewed pinned versions, and change the script to use a private per-run working directory and a user-selected output directory.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:109
Finding

Unvalidated OAuth Token Endpoint Allows Signed JWT Disclosure and Server-Side Request Forgery

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:42
Finding

Unpinned Third-Party Dependencies Create a Supply-Chain Execution Risk

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
gen_report.py:43
Finding

Predictable Shared Temporary Paths Permit Local File and Symlink Substitution

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

md
"""Query Search Console Search Analytics API.
    
    Args:
        token: OAuth2 access token
        site_url: Full property URL, e.g. "https://www.example.com/"
        dimensions: List of dimensions. Valid values:
            - "date"    — daily breakdown

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

"dimensions": dimensions, "rowLimit": row_limit, } resp = requests.post(url, headers={"Authorization": f"Bearer {token}"}, json=body) resp.raise_for_status() return resp.json().get("rows", [])

text

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 425)May include surrounding context.

md
| `jwt.encode` error | Missing `cryptography` package | `pip install cryptography` |
| PDF shows garbled Chinese | Wrong font | Use TTFont with STHeiti, NOT UnicodeCIDFont with STSong-Light |
| Matplotlib timeout on first run | Building font cache | Set bash timeout to 180000ms; this only happens once |
| `MPLCONFIGDIR` warning | No write access to `~/.matplotlib` | Harmless; matplotlib creates a temp cache automatically |

## Example Usage

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The natural-language comments prescribe a mandatory font choice for CJK/Korean support and explicitly forbid an alternative ('NEVER use STHeiti alone'). This hard-codes a locale/language presentation decision rather than offering a user choice, which matches the policy category for forced language or locale behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code creates a temporary chart directory and later saves multiple PNG files and a PDF report, but only prints progress messages such as 'Generating charts' and 'PDF saved' after the fact. There is no prior disclosure in comments, docstring, or confirmation that the skill will write files to /tmp and a user-specific reports directory.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.