ClawHub
Back to skill

Security audit

Google AI Overview API - AI Mode Answers with Citations

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Scavio API integration for fetching Google AI Mode results, with its external request behavior and API-key requirement visible in the instructions.

Before installing, understand that your query and any optional location or language parameters are sent to Scavio's external API and each request costs one credit. Avoid sending sensitive searches or precise location data unless that is necessary for your task.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill sends user-provided queries and optional localization data (`gl`, `hl`, `location`, `uule`) to a third-party service, but the user-facing description and guardrails do not clearly disclose that external transmission occurs. This creates a privacy and consent risk because users may provide sensitive research topics or location-specific inputs without realizing they are being shared outside the local agent environment.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:35