Google Alerts Monitor

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:53 AM UTC
• Version: 1.0.3

Overview

This skill fetches user-configured Google Alerts RSS results and formats them, with no hidden persistence, posting, destructive behavior, or remote code execution found.

Before installing, understand that this is not a general web-search engine: it reads Google Alerts RSS feeds that you configure. Only use feed IDs you are comfortable exposing to the agent environment, and avoid placing sensitive alert identifiers in shared shell profiles or logs.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The description suggests an end-to-end monitoring skill that searches the web for keywords and supports ongoing competitive intelligence use cases. However, this code chunk is strictly a formatter: it parses command-line arguments, loads JSON from stdin or a file, truncates text, and renders cards/dashboard output. It does not initiate web searches, query any external service, monitor over time, or generate reports from freshly gathered data. The Hootsuite-style formatting claim is accurate, but the main declared capability—monitoring via free web search—is not implemented in this code, making the description materially broader than the actual behavior shown.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence
• Finding: The code generally aligns with the broad goal of keyword monitoring, but it does not actually execute a free web search across the web in the ordinary sense. Instead, it retrieves results from a preconfigured Google Alerts RSS feed using a required GOOGLE_ALERT_FEED_ID. That is a materially narrower and different mechanism than the declared description suggests. Additionally, the declared output claims Hootsuite-style formatting, while the implementation emits raw JSON objects. There are no obvious unrelated or dangerous extra capabilities beyond network access to Google Alerts, but the description does not accurately represent the true behavior and dependencies.

External Script Fetching

High

• Category: Supply Chain

Content

- GOOGLE_ALERT_FEED_ID
      bins:
        - bash
        - curl
        - python3
---

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares that it requires shell and network-capable binaries (`bash`, `curl`, `python3`) but does not define any explicit tool scope or permission boundaries. In an agent environment, this weakens governance and can allow broader-than-expected execution and outbound access, increasing the risk of misuse or accidental data exfiltration.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The manifest presents the skill as a generic keyword monitor using free web search, but the implementation depends on a preexisting GOOGLE_ALERT_FEED_ID value to access a specific Google Alerts RSS feed. That is a materially narrower and different operating model than ordinary ad hoc web search, because the skill cannot function without prior feed setup tied to an alerts account/feed.

Intent-Code Divergence

Low

• Confidence: 84% confidence
• Finding: The inline comment says the feed is public and works without authentication, yet the script explicitly refuses to run unless GOOGLE_ALERT_FEED_ID is supplied. While this may not be formal authentication, the documentation implies open access when the actual code depends on possession of a feed-specific identifier.

Static analysis

No suspicious patterns detected.