ClawHub
Back to skill

Security audit

谷歌搜索工具

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a Google search helper, but it requests broad command/file authority and includes unsafe credential handling guidance that users should review before installing.

Install only if you are comfortable granting command execution and filesystem access to this search workflow. Prefer setting Google credentials through a managed secret mechanism or temporary environment variables, do not print API keys, avoid committing .env files, and treat the broad write/file-processing claims as a reason to review or narrow the skill before use.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:290
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:290-291
Vulnerability Type: Unpinned and integrity-unverified dependencies
Risk Level: Medium

Vulnerable Code

bash
pip install requests
pip install python-dotenv

Technical Analysis

The skill recommends installing third-party packages without fixed versions, cryptographic hashes, a lockfile, or an explicitly trusted package index. Consequently, package resolution can vary over time and between environments.

Package installation can execute package-controlled build or installation logic. If the package registry, a dependency, the configured package index, or local package-resolution settings are compromised, an unintended package version could execute code under the privileges of the user running the agent. The reviewed project does not include a dependency manifest that constrains or verifies the resolved artifacts.

No malicious dependency or unsafe alternative registry was identified in the reviewed file. The risk arises from mutable, integrity-unverified dependency resolution.

Attack Path

  1. A user or agent follows the dependency installation guidance in SKILL.md.
  2. pip resolves the latest compatible package versions from its configured index.
  3. An attacker compromises an upstream release, transitive dependency, configured mirror, or package-resolution environment.
  4. The malicious package artifact is downloaded and installed without hash verification.
  5. Package-controlled installation or imported runtime code executes with the installing user's privileges.

Impact Assessment

Successful exploitation could provide arbitrary code execution in the Python installation context. Depending on the agent's operating privileges, this could expose local files, environment variables, Google API credentials, and other credentials available to the process. It could also permit modification of files writable by the user and unauthorized ...[truncated 32 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin every direct and transitive dependency to a reviewed version.
  • Maintain a lockfile or hash-validated requirements file.
  • Install with hash enforcement, such as pip install --require-hashes -r requirements.txt.
  • Explicitly use an approved HTTPS package index and prevent fallback to untrusted mirrors.
  • Review package provenance and vulnerability advisories before updating.
  • Run dependency installation and the resulting search client in an isolated, least-privileged environment.
  • Avoid instructing an agent to install packages automatically; require explicit user approval for environment changes.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:6
Finding

Search Skill Declares Excessive Filesystem and Command-Execution Permissions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:6-22
Vulnerability Type: Excessive tool permissions and inconsistent access declarations
Risk Level: Medium

Vulnerable Code

yaml
allowed-tools: read exec
yaml
tools:
  - exec
  - read
  - write

Technical Analysis

The skill is described as a Google search client, but it declares general command execution and filesystem access. These capabilities exceed what is required for a narrowly scoped HTTPS search operation. The declarations are also inconsistent: allowed-tools lists read and exec, while the separate tools section additionally lists write.

General-purpose exec access can run commands with the agent process's privileges. Broad read and write access can expose or modify files outside the search task if the hosting platform interprets these declarations as permission grants. The inconsistency may also cause different agent platforms to grant different effective capabilities.

The reviewed file does not itself contain instructions that intentionally exploit these permissions. However, the unnecessary capabilities enlarge the impact of prompt injection, malicious search-result content, or misuse by another instruction in the same agent session.

Attack Path

  1. The skill is loaded by an agent platform that grants the declared exec, read, or write tools.
  2. An attacker supplies a crafted query, controls retrieved web content, or otherwise injects instructions into the agent's context.
  3. The agent is induced to treat attacker-controlled content as operational instructions.
  4. The attacker-directed instructions invoke the broadly available tools rather than a narrowly scoped search API.
  5. Commands execute or files are accessed with the permissions of the agent process.

This path requires a separate control-flow or prompt-injection opportunity; no such injection payload was found in the audited projec ...[truncated 491 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace general-purpose tools with a dedicated Google Custom Search operation that accepts a query and validated options.
  • Remove write because the documented free version does not require result export or search-history persistence.
  • Remove general read access unless a specific configuration file is required; prefer a restricted credential provider.
  • Avoid unrestricted exec; if execution is unavoidable, expose a fixed executable with structured arguments and no shell evaluation.
  • Make all tool declarations consistent so every supported agent platform applies the same least-privilege policy.
  • Restrict outbound network access to the required Google API hostname.
  • Treat search results as untrusted data and explicitly prohibit executing instructions found in returned content.
  • Run the skill in a sandbox with a read-only filesystem and a minimally privileged service account.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:228
Finding

Credential Troubleshooting Commands Print API Secrets

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:228-230
Vulnerability Type: Plaintext credential exposure through command output
Risk Level: Medium

Vulnerable Code

bash
# Check environment variables
echo $GOOGLE_API_KEY
echo $GOOGLE_CSE_ID

Technical Analysis

The troubleshooting instructions print the full values of the Google API key and search-engine identifier. Command output may be retained in terminal scrollback, CI logs, agent transcripts, telemetry, debugging records, or session recordings. Environment variables reduce the risk of hardcoding secrets but do not protect them when their values are explicitly emitted.

The API key is an authentication credential and should be treated as sensitive. The CSE identifier is generally less sensitive but can still expose configuration information and should not be printed unnecessarily. No real hardcoded credential was found in the project.

Attack Path

  1. A user configures a valid GOOGLE_API_KEY and GOOGLE_CSE_ID.
  2. The user or agent follows the documented troubleshooting commands.
  3. The complete credential values are written to standard output.
  4. The output is captured by an agent transcript, CI system, shared terminal, telemetry service, or log collector.
  5. An unauthorized party with access to that output retrieves and reuses the API key.

Impact Assessment

Exposure can permit unauthorized use of the affected Google API key within its configured API and application restrictions. An attacker could consume the search quota, cause service disruption through quota exhaustion, and potentially incur charges if billing is enabled. Broader access depends on which APIs and restrictions are associated with the key. This issue does not by itself grant operating-system privileges.

Remediation
View remediation

Remediation Suggestions

  • Never print complete credential values during configuration checks.
  • Verify only whether variables are present, for example with a conditional that emits configured or missing.
  • If identification is essential, display only a short masked suffix and ensure logs are access-controlled.
  • Configure Google API key restrictions for the Custom Search API, expected clients, and applicable network boundaries.
  • Enable secret masking in CI and agent logs.
  • Rotate any key that may already have appeared in output or retained transcripts.
  • Store credentials in a managed secret store and inject them only into the narrowly scoped search process.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 148)May include surrounding context.

  1. 配置环境变量：
bash
# 创建 .env 文件
cat > .env <<EOF
GOOGLE_API_KEY=your_api_key_here
GOOGLE_CSE_ID=your_cx_id_here

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

  1. 配置环境变量：
bash
# 创建 .env 文件
cat > .env <<EOF
GOOGLE_API_KEY=your_api_key_here
GOOGLE_CSE_ID=your_cx_id_here

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation says the free version does not support export or similar advanced operations, yet nearby text repeatedly instructs use of input_params for create/query/export actions. Contradictory instructions can cause an agent or user to invoke unsupported workflows, potentially leading to unintended tool use, unsafe fallbacks, or trust in fabricated capabilities.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger conditions are broad enough to match many generic SEO, research, and marketing tasks, which can cause the skill to activate outside its narrow intended function as a simple search helper. Over-broad routing increases the risk of unnecessary command execution or credential-dependent workflows being selected for unrelated prompts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The instructions tell users to create a .env file containing live API credentials, but they do not prominently warn about common secret-management risks such as source control exposure, shell history capture, or shared workspace leakage. In an agent environment with read/write tools, local secret files are particularly sensitive because other tasks or tools may inadvertently access them.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill is presented as a Google search utility, but later claims broad file-processing, API integration, command execution, and write capabilities that are not clearly required for a search-only tool. This scope inflation increases the chance that an agent will grant or use unnecessary privileges, expanding the attack surface and enabling misuse beyond the declared purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The description highlights Chinese interaction support and presents the skill primarily in Chinese, but does not clearly state that users may choose their preferred language for interaction or outputs. Under the policy, language constraints should be opt-in or explicitly justified rather than implicitly imposed.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill advises against hardcoding secrets but then instructs users to place API credentials into a local .env file without sufficiently constraining handling, storage, or exclusion from version control. While .env use is common, presenting it casually can still lead to accidental leakage through commits, logs, or workspace sharing.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.