ClawHub
Back to skill

Security audit

Google Cloud STS

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real Google Cloud STS connector, but it can return cloud access tokens while describing that action as safe/read-like and broadly auto-routable.

Install only if you specifically need an OOMOL-backed Google Cloud STS token exchange. Treat returned access tokens as secrets: do not paste them into chat unnecessarily, log them, or reuse them outside the requested task. Review the oo CLI installer before running remote install commands, and prefer explicit confirmation before any token is minted.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The skill is advertised as suitable for "searching and reading data," but its only documented action returns a Google Cloud access token. That mismatch can cause an agent or user to invoke a credential-issuing capability under the assumption that it is a harmless read-only integration, increasing the chance of unintended credential exposure or misuse.

Intent-Code Divergence

High
Confidence
97% confidence
Finding
The safety section claims untagged actions are reads, but the untagged action issues an access token, which is a credential operation rather than a read. Mislabeling a credential-minting action as safe-to-run directly lowers operator and agent caution and can lead to silent retrieval of usable cloud credentials.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The invocation text says to use this skill for ANY Google Cloud STS request, which is overly broad for a skill whose documented function is token exchange. That can cause the skill to be selected in unrelated STS contexts and unnecessarily expose credential-issuing functionality where a safer informational path would suffice.

Credential Access

High
Category
Privilege Escalation
Content
## Available actions

- `get_federated_access_token` — Exchange the connected OOMOL OIDC token with Google Cloud Workload Identity Federation and return a Google Cloud access token.

## Safety
Confidence
96% confidence
Finding
The skill explicitly provides a Google Cloud access token, which is inherently a credential-access capability. In this context that may be the intended feature, but it is still security-sensitive because any overbroad invocation, logging, or disclosure of the token could enable unauthorized access to Google Cloud resources within the granted scope.

External Script Fetching

High
Category
Supply Chain
Content
- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell
Confidence
90% confidence
Finding
The setup instructions recommend piping a remote script directly into `bash`, which is a classic supply-chain and remote-code-execution risk if the hosting endpoint or transport is compromised. Because this appears in a skill document, an agent or user may execute it with little scrutiny during troubleshooting.

Static analysis

No suspicious patterns detected.