ClawHub
Back to skill

Security audit

Google Search

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate Google search skill, but its installer can modify the host Python environment using an unpinned dependency and its privacy guidance for sending searches to Google is incomplete.

Review the installer before running it. Prefer installing google-genai in a virtual environment with a pinned version, and avoid putting secrets, credentials, private customer data, or sensitive internal terms into searches because queries are sent to Google APIs. Set GOOGLE_SEARCH_LANG and GOOGLE_SEARCH_COUNTRY explicitly if Hebrew/Israel defaults are not what you want.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
install.sh:8
Finding

Unpinned System-Wide Python Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: install.sh, lines 8–12
Vulnerability Type: Unpinned third-party dependency installation with managed-environment protections bypassed
Risk Level: Medium

Vulnerable Code

bash
pip install --break-system-packages --quiet google-genai 2>/dev/null || {
    echo "⚠️  pip install failed, trying without --break-system-packages..."
    pip install --quiet google-genai 2>/dev/null || {
        echo "❌ Failed to install google-genai. Install manually: pip install google-genai"
        exit 1
    }
}

Technical Analysis

The installer downloads and installs the latest version of google-genai, together with its transitive dependencies, from the invoking environment's configured Python package index. It provides no version constraint, lockfile, package hash, or other integrity verification. Consequently, the code installed by the Skill can change without any modification to the reviewed project.

The first installation attempt also uses --break-system-packages, which bypasses Python's externally managed environment protection. This can alter the host's system-level Python environment rather than confining the dependency to an isolated virtual environment. Suppression of standard error with 2>/dev/null further reduces visibility into package-resolution warnings and installation failures.

This is a supply-chain weakness rather than evidence that the current google-genai package is malicious. Exploitation depends on compromise of a selected package release, a transitive dependency, the configured package index, or the package-resolution path.

Attack Path

  1. An attacker compromises a future google-genai release, one of its transitive dependencies, or a Python package index configured on the target system.
  2. A user executes install.sh.
  3. pip resolves the mutable, unconstrained package set and downloads the attacker-controlled component.
  4. Malic ...[truncated 1165 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin google-genai and all transitive dependencies to reviewed versions using a lockfile.
  2. Require package hashes, such as with pip install --require-hashes -r requirements.txt, to verify artifact integrity.
  3. Install dependencies in a dedicated virtual environment rather than modifying the system Python environment.
  4. Remove --break-system-packages; fail safely if no isolated environment is available.
  5. Use an explicitly trusted package index and, where practical, an organization-controlled package mirror.
  6. Do not suppress all installation errors. Preserve security warnings and resolver diagnostics while keeping routine output concise.
  7. Periodically review and update pinned dependencies through a controlled process that includes vulnerability scanning and testing.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Lp1

High
Category
MCP Least Privilege
Confidence
97% confidence
Finding

The skill makes network calls to Google APIs and Gemini Search Grounding, sending user-supplied queries and locale hints off-platform. If network capability is undeclared, this can lead to undisclosed exfiltration of sensitive prompts, internal search terms, or regulated data entered by users who assume the skill operates locally.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
97% confidence
Finding

The skill makes network calls to Google APIs and Gemini Search Grounding, sending user-supplied queries and locale hints off-platform. If network capability is undeclared, this can lead to undisclosed exfiltration of sensitive prompts, internal search terms, or regulated data entered by users who assume the skill operates locally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill sends user queries to external Google services, but the user-facing description does not clearly warn that prompts, search terms, and possibly surrounding task context may leave the local environment. This creates a privacy and data-handling risk because users may unknowingly submit sensitive information to third-party APIs under the assumption that this is just an internal tool.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Defaulting searches to Hebrew and Israel-specific locale without explicit user opt-in can alter search results, reveal geographic assumptions, and unintentionally disclose regional preferences or identity context to the third-party provider. In a search skill, locale materially affects both privacy and integrity because results may be biased toward a specific language/region even when the user did not request that behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.