google-image-api-skill

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:59 AM UTC
• Version: 1.0.0

Overview

The skill mostly does what it claims, but it asks users to provide an API key to the agent, which is unsafe secret handling.

Review before installing. Use this only if you are comfortable sending image-search terms and task parameters to BrowserAct. Configure BROWSERACT_API_KEY through your environment or an approved secret manager, do not paste the key into chat, and rotate the key if it has already been shared in a conversation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:25
• Finding: BrowserAct API Key May Be Disclosed Through Agent Conversations< to get your Key first." ``` `scripts/google_image_api.py:89-96`: ```python if not api_key: print("\n[!] ERROR: BrowserAct API Key is missing.", flush=True) print("Please follow these steps:", flush=True) print("1. Go to: https://www.browseract.com/reception/integrations", flush=True) print("2. Copy your API Key.", flush=True) print("3. Provide it to me or set it as an environment variable (BROWSERACT_API_KEY).", flush=True) sys.exit(1) ``` ### Technical Analysis The implementation correctly supports loading the BrowserAct credential from the `BROWSERACT_API_KEY` environment variable. However, the Skill documentation directs the Agent to wait for the user to provide the key, while the script explicitly tells the user to “Provide it to me.” This guidance can cause users to paste a bearer credential into an Agent conversation. Such credentials may then be retained in conversation history, execution traces, monitoring systems, support exports, or other logs accessible to parties that do not need the secret. Conversational disclosure is not required for the declared Google Images extraction functionality. The script can obtain the credential exclusively from an environment variable or secret manager. Therefore, soliciting it through the Agent exceed ...[truncated 1792 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all instructions that ask users to provide API keys to the Agent or paste them into a conversation. 2. Change the documentation to require local configuration through an environment variable or supported secret manager. 3. Replace the script message with guidance such as: ```python print( "Set BROWSERACT_API_KEY in your local environment or approved secret manager. " "Do not paste the key into chat or command-line arguments.", flush=True, ) ``` 4. Continue reading the credential only through `os.getenv("BROWSERACT_API_KEY")`; do not add command-line credential support because command lines may be recorded in shell history and process listings. 5. Ensure exceptions, request diagnostics, and debug logs never include authorization headers. 6. Recommend immediate revocation and rotation when a user has already pasted a key into a conversation. 7. Where supported, use scoped API credentials with minimum permissions, quota limits, expiration, and usage alerts. 8. Document that the key is sent only to `https://api.browseract.com` for the declared API operation. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises and relies on environment access and outbound network/API use, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates a governance gap where an agent may invoke code with broader capabilities than users or platform policy expect, increasing the risk of unauthorized secret access or unreviewed external requests.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The description says the agent should proactively apply this skill across a wide range of loosely defined scenarios, which can cause the skill to trigger without sufficiently specific user intent. In context, that matters because activation would send search terms and related parameters to an external service, potentially disclosing sensitive research topics or causing unintended API usage/cost.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill does not clearly warn that user-provided keywords, country/language selections, and possibly resulting metadata are transmitted to BrowserAct, an external API service. This lack of transparency can lead users to unknowingly expose confidential queries, competitive research intent, or regulated/sensitive data to a third party.

External Transmission

Medium

• Category: Data Exfiltration

Content

# API Configuration
TEMPLATE_ID = "82307120300629613"
API_BASE_URL = "https://api.browseract.com/v2/workflow"

def run_google_image_task(api_key, keywords, country="us", language="en", scroll_count=5, datelimit=50):
    headers = {"Authorization": f"Bearer {api_key}"}

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

# 1. Start Task
    print(f"Start Task", flush=True)
    try:
        res = requests.post(f"{API_BASE_URL}/run-task-by-template", json=payload, headers=headers).json()
    except Exception as e:
        print(f"Error: Connection to API failed - {e}", flush=True)
        return None

• Confidence: 90% confidence
• Finding: This POST request transmits user-controlled query data and authentication material to an external service. While external API use is expected for this skill, the risk is real because search terms may include sensitive business intelligence, personal data, or research topics, and the transfer occurs without safeguards such as disclosure, validation, or consent gating.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script sends user-supplied search keywords, country, language, and task parameters to BrowserAct, an external third-party API, without any explicit disclosure at the point of collection or transmission. In an agent skill context, users may assume processing is local, so undisclosed external transfer of potentially sensitive search terms creates a privacy and data-handling risk.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The script tells the user to 'Provide it to me or set it as an environment variable,' which encourages disclosure of a secret directly in conversation or plain input. In an agent setting, this increases the chance that API keys are exposed in chat logs, tool traces, prompts, or other retention systems.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: The function defaults the language parameter to "en", which establishes a specific language preference automatically. While the CLI allows override, the default still imposes an English locale choice rather than prompting the user or documenting a justified locale restriction.

Missing User Warnings

Low

• Confidence: 76% confidence
• Finding: Reading API keys from environment variables is expected, but this file lacks a docstring or comment near the access explaining that it consumes a sensitive credential for external API authentication. The later error message helps when the key is missing, but it does not serve as advance disclosure of sensitive environment access during normal execution.

Static analysis

No suspicious patterns detected.