ClawHub
Back to skill

Security audit

Google AI Mode Search

Security checks for vulnerabilities and agentic risk

Overview

This skill is a Google search automation helper, but it asks users to expose sensitive Google session access and leaves a powerful browser debugging interface running with weak controls.

Review this carefully before installing. Use only a dedicated low-privilege Google account, do not export primary-account cookies, lock down any cookie file permissions, and avoid keeping Chrome DevTools Protocol running continuously. Be aware that the launcher can kill existing Chrome sessions and that any local process reaching the debugging port may control or inspect the dedicated browser.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
gaimode-cli.py:20
Finding

Google session cookies are stored without enforced access controls

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
start-chrome-cdp.sh:7
Finding

Chrome launcher forcibly terminates unrelated browser processes

Content
View full analysis
/dev/null sleep 2 ``` ### Technical Analysis The launcher invokes `pkill -9` by process name before starting its dedicated Chrome instance. This can target every matching Chrome process visible to the invoking user rather than only a browser instance previously created by this skill. Signal 9 (`SIGKILL`) cannot be handled by the target process and prevents graceful shutdown. Chrome therefore has no opportunity to complete ordinary shutdown processing, prompt about unsaved data, or cleanly flush transient browser state. Starting a dedicated browser profile on port 9222 does not require terminating unrelated Chrome sessions. ### Attack Path 1. The user has one or more ordinary Chrome sessions open, potentially containing unsaved form data or active work. 2. The user follows the skill documentation and executes `start-chrome-cdp.sh`. 3. `pkill -9 "Google Chrome"` terminates all matching processes available to the user's account. 4. Active browser sessions are abruptly interrupted. 5. Unsaved work may be lost, and browser profile state may require recovery on the next launch. This finding is directly triggered by normal use and does not require external attacker-controlled input. ### Impact Assessment The command can cause a user-level denial of service against unrelated Chrome sessions. Potential consequences include loss of unsaved browser work, interrupted downloads or sessions, and browser recovery prompts. The command executes with the caller's privileges. It does not independently cross an operating-system privilege boundary, and its process scope is generally limited to processes the caller is authorized to signal. ]]>
Remediation
View remediation
"$PID_FILE" ``` 4. If a stop operation is needed, validate the stored PID and command identity, then send `SIGTERM` only to that dedicated process. 5. Reserve `SIGKILL` for a separate, explicit fallback after a graceful shutdown timeout and user confirmation. 6. Clearly document that the skill launches an isolated Chrome instance without interfering with the user's regular browser. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
start-chrome-cdp.sh:11
Finding

Persistent unauthenticated CDP endpoint exposes broad control over the dedicated browser

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation instructs users to export Google cookies and save them locally, but does not clearly warn that these cookies are authentication secrets that may permit account access if stolen. In an agent-skill context, encouraging local storage of reusable session material increases the chance of credential leakage through weak file permissions, backups, logs, or other tools that can read the file.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The module docstring presents the tool as a 'Google AI Mode Search Tool', and the CLI help repeats that framing. However, both search implementations navigate to 'https://www.google.com/search?udm=50&q=...' rather than a distinct AI Mode interface, while also using Chrome CDP or imported cookies to fetch page text. This is an intent-level contradiction between the documented purpose and the implemented behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The tool stores and reuses browser-exported cookies from a local JSON file to authenticate automated sessions, but it provides only minimal warning despite the high sensitivity of session cookies. If the file is stolen, mishandled, or users are encouraged to export full browser cookies without safeguards, an attacker could hijack authenticated sessions or expose private account data.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · gaimode-cli.py (reported line 30)May include surrounding context.

python
def is_cdp_running():
    """Check if Chrome CDP is running on port 9222"""
    try:
        result = subprocess.run(['curl', '-s', '--max-time', '3', 'http://localhost:9222/json/version'], 
                               capture_output=True, text=True)
        return 'Chrome' in result.stdout
    except:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · gaimode-cli.py (reported line 39)May include surrounding context.

python
def get_cdp_ws_url():
    """Get WebSocket URL from Chrome CDP"""
    try:
        result = subprocess.run(['curl', '-s', 'http://localhost:9222/json/version'], 
                               capture_output=True, text=True)
        data = json.loads(result.stdout)
        return data.get('webSocketDebuggerUrl')

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The 'search' subcommand is documented as 'Search Google AI Mode'. In execution, 'search_cdp' and 'search_cookies' open a regular Google search URL, wait, and then scrape the visible body text, which does not match the stated command intent. This is a direct mismatch between command documentation and actual code behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The header comment says to 'Run ONCE, keep it open for 24/7 access', implying a benign persistent launcher, but the script's first operational step is to terminate all matching 'Google Chrome' processes with pkill -9. That is an active side effect contradicting the implied behavior of simply starting and keeping one browser instance open.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script forcefully terminates all matching Google Chrome processes with SIGKILL and no confirmation, which can cause denial of service, loss of unsaved user data, and interruption of unrelated browsing sessions. In the context of a skill intended to expose Chrome DevTools remotely, this behavior is more dangerous because it disrupts an active browser environment in order to bring up a debug-enabled instance.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.