ClawHub
Back to skill

Security audit

Serper Search

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Serper.dev search helper with expected third-party API calls, but users should avoid sending sensitive queries and should treat lead-generation contact data carefully.

Install only if you want an agent to query Serper.dev on your behalf. Do not use it with secrets, confidential business plans, regulated personal data, or private internal prompts. For lead generation, confirm that collecting and using business contact information complies with applicable laws, platform terms, and your organization's policies.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The invocation description is extremely broad ('any information', research, leads, businesses), making it likely to trigger for many generic user requests where sending the query to an external search provider may be unnecessary or unexpected. In agent settings, overbroad routing can cause inadvertent disclosure of sensitive prompts or user data to a third party.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The description does not warn that user queries are sent to Serper.dev, a third-party API, along with the API key in the request headers. Users or calling agents may therefore submit sensitive or proprietary search terms without understanding the external disclosure.

External Transmission

Medium
Category
Data Exfiltration
Content
"Content-Type": "application/json"
    }
    payload = {"q": query, "num": num, "gl": gl}
    r = requests.post("https://google.serper.dev/search", headers=headers, json=payload)
    r.raise_for_status()
    
    results = r.json().get("organic", [])
Confidence
93% confidence
Finding
The repeated finding refers to the same outward network request to the Serper search endpoint. Although expected behavior for a search skill, it remains security-relevant because broad invocation language increases the chance that sensitive prompts are unnecessarily transmitted off-platform.

External Transmission

Medium
Category
Data Exfiltration
Content
"Content-Type": "application/json"
    }
    payload = {"q": query, "num": num, "gl": gl}
    r = requests.post("https://google.serper.dev/search", headers=headers, json=payload)
    r.raise_for_status()
    
    results = r.json().get("organic", [])
Confidence
93% confidence
Finding
The repeated finding refers to the same outward network request to the Serper search endpoint. Although expected behavior for a search skill, it remains security-relevant because broad invocation language increases the chance that sensitive prompts are unnecessarily transmitted off-platform.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The skill metadata and top-level description frame the capability as generic web search returning organic results, but the file also exposes a Places workflow that returns addresses and phone numbers for lead generation. That mismatch can cause downstream systems or users to invoke the skill without realizing it collects and transmits business-contact queries to a third-party service, increasing privacy, compliance, and scope-of-use risk.

External Transmission

Medium
Category
Data Exfiltration
Content
"""
    headers = {"X-API-KEY": os.environ["SERPER_API_KEY"], "Content-Type": "application/json"}
    payload = {"q": query, "gl": gl}
    r = requests.post("https://google.serper.dev/places", headers=headers, json=payload)
    return r.json().get("places", [])

# Places returns website URLs + phone numbers directly — great for lead gen!
Confidence
94% confidence
Finding
The repeated finding refers to the same Places endpoint request, which transmits user queries externally and enables structured collection of business contact information. The skill context makes this moderately more dangerous because it explicitly markets lead-generation usage, encouraging higher-volume harvesting of contact data.

External Transmission

Medium
Category
Data Exfiltration
Content
"""
    headers = {"X-API-KEY": os.environ["SERPER_API_KEY"], "Content-Type": "application/json"}
    payload = {"q": query, "gl": gl}
    r = requests.post("https://google.serper.dev/places", headers=headers, json=payload)
    return r.json().get("places", [])

# Places returns website URLs + phone numbers directly — great for lead gen!
Confidence
94% confidence
Finding
The repeated finding refers to the same Places endpoint request, which transmits user queries externally and enables structured collection of business contact information. The skill context makes this moderately more dangerous because it explicitly markets lead-generation usage, encouraging higher-volume harvesting of contact data.

Missing User Warnings

Low
Confidence
84% confidence
Finding
The lead-generation and Places guidance encourages collection of business websites, phone numbers, and addresses but omits compliance and acceptable-use warnings. While business contact data is often public, packaging it for lead generation through an external service can create privacy, terms-of-service, or policy issues if users are not informed.

Static analysis

No suspicious patterns detected.