ClawHub
Back to skill

Security audit

谷歌搜索(免费版)

Security checks for vulnerabilities and agentic risk

Overview

The skill appears intended for Google search automation, but its broad command/write permissions and unsafe install guidance deserve user review before installation.

Install only if you are comfortable with an agent running browser automation and local commands for Google searches. Prefer Node.js or a verified package-manager install path over the curl-to-shell Bun command, run it in a dedicated workspace, and ask the agent to confirm before writing exported result files.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Description-Behavior Mismatch

Medium
Confidence
77% confidence
Finding
The skill is marketed as a narrowly scoped Google search tool, but later describes generic file handling, API integration, and command execution capabilities. That scope expansion increases the chance an agent will invoke broader, riskier behaviors than a user intended, enabling unnecessary file writes or command execution under a misleading trust boundary.

Vague Triggers

Medium
Confidence
73% confidence
Finding
The activation language is very broad and tied to common SEO-related needs, which can cause the agent to select this skill in contexts where browser automation, file output, or command execution were not expected. In an agent environment, overbroad routing increases the risk of unintended tool use and excessive privilege exposure.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The documentation instructs exporting results to files without prominently warning users that the skill may create or overwrite local artifacts. In agent workflows, silent file creation is a meaningful side effect that can surprise users, leak collected data to disk, or modify workspace state unexpectedly.

External Script Fetching

High
Category
Supply Chain
Content
| 依赖项 | 类型 | 是否必需 | 获取方式 |
|:-------|:-----|:---------|:---------|
| Node.js 16+ | 运行时 | 二选一 | 官网下载安装 |
| Bun 1.0+ | 运行时 | 二选一 | `curl -fsSL https://bun.sh/install \| bash` |
| Playwright | npm包 | 必需 | `npm install playwright` |
| Chromium | 浏览器 | 必需 | `npx playwright install chromium` |
| Python 3.8+ | 运行时 | 可选 | 辅助脚本使用 |
Confidence
96% confidence
Finding
The skill recommends piping a remote script directly into bash via curl, which executes unverified code fetched at install time. If the remote source, transport, mirror, or user environment is compromised, this becomes arbitrary code execution on the host running the agent or user setup.

Static analysis

No suspicious patterns detected.