ClawHub
Back to skill

Security audit

Google Developer Knowledge

Security checks for vulnerabilities and agentic risk

Overview

The skill is for fetching Google developer docs, but its MCP routing and REST examples create review-worthy risks around where queries and credentials may go.

Install only if you control and trust the configured MCP server or set a known preferred server/config. Do not put secrets, proprietary code, incident details, customer data, or private URLs into documentation queries, and prefer safer credential handling than the raw curl examples when using REST.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
references/mcporter-workflow.md:44
Finding

Capability-Only MCP Discovery Can Route Queries to an Untrusted Server

Content
View full analysis
/dev/null)" || { failures+=("$server:schema-unavailable") continue } else schema="$(mcporter list "$server" --schema --json --timeout "$gdk_timeout_ms" 2>/dev/null)" || { failures+=("$server:schema-unavailable") continue } fi if jq -e ' [.tools[]?.name] as $tools | ($tools | index("GoogleDeveloperKnowledge-search_documents")) and ($tools | index("GoogleDeveloperKnowledge-get_documents")) and ($tools | index("GoogleDeveloperKnowledge-answer_query")) ' >/dev/null <<<"$schema"; then jq -nc --arg server "$server" '{server: $server, tools: {search: "GoogleDeveloperKnowledge-search_documents", get: "GoogleDeveloperKnowledge-get_documents", answer: "GoogleDeveloperKnowledge-answer_query"}}' exit 0 fi if jq -e ' [.tools[]?.name] as $tools | ($tools | index("search_documents")) and ($tools | index("get_documents")) and ($tools | index("answer_query")) ' >/dev/null <<<"$schema"; then jq -nc --arg server "$server" '{server: $server, tools: {search: "search_documents", get: "get_documents", answer: "a ...[truncated 3282 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
references/api-fallback.md:34
Finding

REST Examples Expose API Keys and OAuth Tokens in Process Arguments

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api-fallback.md (reported line 23)May include surrounding context.

OAuth with a Quota Project

Use this alternative when an OAuth access token and quota project are available. Do not persist a short-lived access token in an MCP configuration.

bash
export DEVELOPERKNOWLEDGE_OAUTH_ACCESS_TOKEN="ACCESS_TOKEN"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · test-prompts.json (reported line 59)May include surrounding context.

json
{
      "id": "oauth-rest-fallback-and-budget",
      "mode": "full_test",
      "prompt": "沒有可用 MCP，但有 OAuth access token 和 quota project；查 Cloud Run minimum instances 計費並附來源。",
      "assertions": [
        "Uses the REST OAuth fallback with an Authorization header and x-goog-user-project header.",
        "Retrieves no more than three parent documents unless broad extraction was explicitly requested.",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-fallback.md (reported line 29)May include surrounding context.

md
export DEVELOPERKNOWLEDGE_OAUTH_ACCESS_TOKEN="ACCESS_TOKEN"
export GOOGLE_CLOUD_QUOTA_PROJECT="YOUR_PROJECT_ID"

curl --get "https://developerknowledge.googleapis.com/v1/documents:searchDocumentChunks" \
  --data-urlencode "query=Cloud Run minimum instances billing" \
  -H "Authorization: Bearer $DEVELOPERKNOWLEDGE_OAUTH_ACCESS_TOKEN" \
  -H "x-goog-user-project: $GOOGLE_CLOUD_QUOTA_PROJECT"

Static analysis

No suspicious patterns detected.