Security audit

Jules API

Security checks for vulnerabilities and agentic risk

Overview

This skill is for a real Jules API workflow, but it can start autonomous repository work with permissive defaults and delete remote sessions without confirmation.

Install only if you intend to give this skill access to a Jules API key connected to repositories you are comfortable operating on. Prefer requiring plan approval, avoid auto-PR mode unless explicitly needed, review prompts and target branches before sending them, and be careful with the delete command because the helper does not ask for confirmation.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/jules.sh:77
Finding: Unsafe JSON Construction Permits Request-Body Manipulation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/jules.sh:28
Finding: Jules API Key Is Passed Through the Curl Process Argument Vector
Content: View full analysis
"`. 2. The API key becomes part of curl's process arguments. 3. A local actor with permission to inspect process metadata monitors process listings or the relevant process filesystem interface. 4. The actor captures the header value while curl is active. 5. The stolen key is replayed directly against the Jules REST API. ### Impact Assessment A stolen key grants the privileges assigned to the corresponding Jules account and API credential. Based on the implemented operations, this may include: - Enumerating connected repositories and branches. - Reading sessions, activities, generated patches, command output, and other artifacts. - Creating autonomous coding sessions. - Approving plans and sending instructions. - Deleting sessions. - Initiating automatic pull-request workflows ...[truncated 151 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/jules.sh:83
Finding: Autonomous Repository Task Execution Is Enabled by Default
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.
Content: Scanner excerpt · scripts/jules.sh (reported line 12)May include surrounding context.
sh
# sessions [pageSize] - List sessions # session <sessionId> - Get session details # approve <sessionId> - Approve a pending plan # message <sessionId> <message> - Send message to session # activities <sessionId> [pageSize] - List session activities # activity <sessionId> <activityId> - Get single activity # delete <sessionId> - Delete a session

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.
Content: Scanner excerpt · scripts/jules.sh (reported line 208)May include surrounding context.
sh
# sessions [pageSize] - List sessions # session <sessionId> - Get session details # approve <sessionId> - Approve a pending plan # message <sessionId> <message> - Send message to session # activities <sessionId> [pageSize] - List session activities # activity <sessionId> <activityId> - Get single activity # delete <sessionId> - Delete a session

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill invokes shell commands with curl and makes network requests, but it declares no tool scope such as allowed-tools or permissions. That omission weakens user and platform visibility into what the skill can do and increases the chance of unintended shell/network execution without explicit consent boundaries.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 93% confidence
Finding: The skill explicitly enables an external AI agent to autonomously execute coding tasks on GitHub repositories, including writing code and creating pull requests. In this context, autonomy materially increases risk because actions can affect real repositories and codebases, potentially causing unauthorized or poorly reviewed changes if invoked carelessly.
Content: Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.
md
# Jules API Skill Interact with the [Google Jules](https://jules.google) AI coding agent via its REST API. Jules can autonomously execute coding tasks on your GitHub repositories — writing code, fixing bugs, adding tests, and creating pull requests. **Base URL:** `https://jules.googleapis.com/v1alpha` **Auth:** Pass your API key via the `x-goog-api-key` header. Get one at [jules.google.com/settings](https://jules.google.com/settings).

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill advertises autonomous coding actions on GitHub repositories, including writing code and creating pull requests, without a prominent warning that it can modify external repositories. Users may invoke it without appreciating that it can trigger real changes to source code and repository state outside the local environment.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.
Discover which GitHub repos are connected to your Jules account:

bash
curl -s -H "x-goog-api-key: $JULES_API_KEY" \ "https://jules.googleapis.com/v1alpha/sources?pageSize=30"

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 90% confidence
Finding: The auto-approve/auto-PR workflow compounds autonomous behavior by reducing or removing human checkpoints before external repository changes are made. In a coding-agent skill tied to GitHub repositories, this creates a heightened risk of unintended commits, unsafe code generation, or PR spam against connected projects.
Content: Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.
| requirePlanApproval | No | If true, plans need explicit approval before execution | | automationMode | No | Set to AUTO_CREATE_PR to auto-create PRs when done |

Auto-approve + Auto-PR example

bash
curl -s -X POST \

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The auto-create PR example encourages fully automated external repository modification without an adjacent warning about the consequences. This is dangerous because it normalizes unattended code changes and PR creation against connected repositories, which can lead to accidental or inappropriate modifications.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 84% confidence
Finding: This POST request sends task prompts and repository context to an external AI coding service that can act on connected repositories and create PRs. In context, the danger is not mere transmission but transmission coupled with automated remote code modification, especially in an example that omits strong warnings or safer gating defaults.
Content: Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.
Auto-approve + Auto-PR example

bash
curl -s -X POST \ -H "x-goog-api-key: $JULES_API_KEY" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.
When a session is in AWAITING_PLAN_APPROVAL state, approve the plan:

bash
curl -s -X POST \ -H "x-goog-api-key: $JULES_API_KEY" \ -H "Content-Type: application/json" \ -d '{}' \

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The delete-session command documents a destructive API action without warning that deletion may be irreversible and may remove history or artifacts needed for auditability. Even if limited to sessions rather than repository code, destructive operations should be clearly labeled to reduce accidental loss.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/jules.sh (reported line 32)May include surrounding context.
sh
# Helper: make GET request get() { curl -s -H "$AUTH_HEADER" "$1" } # Helper: make POST request with JSON body

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · scripts/jules.sh (reported line 74)May include surrounding context.
sh
echo "Usage: jules.sh create <sourceId> <branch> <prompt> [title] [--approve] [--auto-pr]" >&2 echo " sourceId: e.g. github-owner-repo" >&2 echo " branch: e.g. main" >&2 echo " --approve: require plan approval (default: auto-approve)" >&2 echo " --auto-pr: auto-create PR when done" >&2 exit 1 fi

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The delete command issues an HTTP DELETE request for a session immediately after checking that a session ID was provided. There is no confirmation prompt, cautionary message, or other user-facing disclosure near this destructive operation, despite it being irreversible from the user's perspective.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Exfiltration Commands

Exfiltration Commands

Undeclared Tool Scope

Autonomous Decision Making

Missing User Warnings

External Transmission

Autonomous Decision Making

Auto-approve + Auto-PR example

Missing User Warnings

External Transmission

Auto-approve + Auto-PR example

External Transmission

Missing User Warnings

External Transmission

Autonomous Decision Making

Missing User Warnings

Static analysis