Google Web Fonts

PassAudited by ClawScan on May 4, 2026.

Overview

This is a documentation-only skill for adding Google Fonts to web pages, with no code, install steps, credentials, or local system access.

This skill appears safe for normal use as a Google Fonts reference. Before installing, be aware that pages using Google Fonts will load resources from Google, and avoid embedding private text in font URL parameters.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

If private or user-specific text is included in a Google Fonts URL, that text may be visible to Google and in logs or browser/network history.

Why it was flagged

The skill documents sending a font request, including an optional text parameter, to Google's font service. This is purpose-aligned, but any text placed in the URL is shared with an external provider.

Skill content

https://fonts.googleapis.com/css?family=Inconsolata&text=Hello%20World

Recommendation

Use Google Fonts URLs only for public page styling, and avoid putting sensitive or private strings in the optional text parameter.