ClawHub
Back to skill

Security audit

Justserpapi Bwm

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its Google search purpose, but it should be reviewed because it passes the Just Serp API key on the command line and sends user search inputs to a third-party API.

Install only if you are comfortable sending search terms, locations, URLs, and related filters to Just Serp API. Treat the API key as sensitive, prefer a wrapper or revised version that reads JUST_SERP_API_KEY directly from the environment instead of command-line arguments, and rotate the key if it may have appeared in process logs or telemetry.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:44
Finding

API Key Exposed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:44 and bin/run.mjs:3549-3564
Vulnerability Type: API credential exposure through process arguments
Risk Level: Medium

Vulnerable Code

bash
node {baseDir}/bin/run.mjs --operation "<operation-id>" --api-key "$JUST_SERP_API_KEY" --params-json '{"key":"value"}'
js
function parseArgs(argv) {
  const parsed = { apiKey: null, operation: null, paramsJson: "{}" };
  for (let index = 0; index < argv.length; index += 1) {
    const flag = argv[index];
    const value = argv[index + 1];

    // Other argument handlers omitted.

    if (flag === "--api-key") {
      parsed.apiKey = value;
      index += 1;
      continue;
    }
    fail(`Unknown argument "${flag}".`);
  }
  return parsed;
}

The credential is then used for the intended authenticated API request:

js
const requestInit = {
  headers: {
    "accept": "application/json",
    "X-API-Key": args.apiKey,
  },
  method: operation.method,
};

Technical Analysis

The documented invocation expands JUST_SERP_API_KEY into the Node process command line. On systems where process arguments are visible to other users, administrators, monitoring agents, job runners, audit systems, or diagnostic tooling, the expanded secret may be captured while the process is running or retained in telemetry.

The subsequent transmission of the key in the X-API-Key header to the fixed HTTPS endpoint https://api.justserpapi.com is necessary for the declared functionality and is not evidence of covert exfiltration. The weakness is specifically the local transport of the key through argv before that request occurs.

Attack Path

  1. A user invokes the Skill using the command documented in SKILL.md.
  2. The shell expands $JUST_SERP_API_KEY and places its value in the Node process argument vector.
  3. A local user or monitoring component with permission to inspect process metadata reads or records the command line.
  4. The observer ...[truncated 839 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the --api-key command-line option and read JUST_SERP_API_KEY directly from process.env:
js
const apiKey = process.env.JUST_SERP_API_KEY;
if (!apiKey) {
  fail("Missing required JUST_SERP_API_KEY environment variable.");
}
  1. Update the documented command so the secret is not expanded into the argument vector:
bash
node {baseDir}/bin/run.mjs \
  --operation "<operation-id>" \
  --params-json '{"key":"value"}'

  1. If direct environment access is unsuitable, accept the secret through standard input or a dedicated credential provider rather than through command-line arguments.

  2. Ensure errors and diagnostics never print request headers, the environment variable, or the complete request configuration.

  3. Redact command-line arguments and secrets in process telemetry, CI logs, shell tracing, and monitoring systems where possible.

  4. Rotate any API key that may previously have been exposed through process listings or retained command-line telemetry.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md
1. Read `generated/operations.md` before choosing an endpoint.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md
- Project site: [Just Serp API](https://justserpapi.com/?utm_source=clawhub.ai&utm_medium=referral&utm_campaign=justserpapi_google&utm_content=project_link).
- Authentication details: [Just Serp API Docs](https://docs.justserpapi.com/?utm_source=clawhub.ai&utm_medium=referral&utm_campaign=justserpapi_google&utm_content=project_link).

## Output Rules

- Lead with the Google surface you used and the exact query or filters applied.
- For SERP-style responses, summarize the top result patterns before raw JSON.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code builds a URL from user-provided parameters and sends it to an external API via fetch, including queries, locations, image URLs, and other potentially sensitive inputs. There is no confirmation prompt, logging/print disclosure before transmission, or explanatory comment/docstring warning that user data will be sent off-box.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This manifest exposes many operations that send user-supplied search terms, locations, image URLs, IDs, and other potentially sensitive inputs to an external third-party service, but it does not clearly disclose that data leaves the platform boundary. That creates a real privacy and trust risk because users or calling agents may unintentionally transmit personal, confidential, or regulated data to Just Serp API while assuming the action is a local capability.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.