google-image-api-skill

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:59 AM UTC
• Version: 1.0.0

Overview

The skill mostly does what it claims, but it asks users to provide an API key to the agent, which is unsafe secret handling.

Review before installing. Use this only if you are comfortable sending image-search terms and task parameters to BrowserAct. Configure BROWSERACT_API_KEY through your environment or an approved secret manager, do not paste the key into chat, and rotate the key if it has already been shared in a conversation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:25

Finding

BrowserAct API Key May Be Disclosed Through Agent Conversations

Content

View full analysis

"Since you haven't configured the BrowserAct API Key yet, please go to the [BrowserAct Console](https://www.browseract.com/reception/integrations) to get your Key first." ``` `scripts/google_image_api.py:89-96`: ```python if not api_key: print("\n[!] ERROR: BrowserAct API Key is missing.", flush=True) print("Please follow these steps:", flush=True) print("1. Go to: https://www.browseract.com/reception/integrations", flush=True) print("2. Copy your API Key.", flush=True) print("3. Provide it to me or set it as an environment variable (BROWSERACT_API_KEY).", flush=True) sys.exit(1) ``` ### Technical Analysis The implementation correctly supports loading the BrowserAct credential from the `BROWSERACT_API_KEY` environment variable. However, the Skill documentation directs the Agent to wait for the user to provide the key, while the script explicitly tells the user to “Provide it to me.” This guidance can cause users to paste a bearer credential into an Agent conversation. Such credentials may then be retained in conversation history, execution traces, monitoring systems, support exports, or other logs accessible to parties that do not need the secret. Conversational disclosure is not required for the declared Google Images extraction functionality. The script can obtain the credential exclusively from an environment variable or secret manager. Therefore, soliciting it through the Agent exceed ...[truncated 1792 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill advertises and relies on environment access and outbound network/API use, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates a governance gap where an agent may invoke code with broader capabilities than users or platform policy expect, increasing the risk of unauthorized secret access or unreviewed external requests.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description says the agent should proactively apply this skill across a wide range of loosely defined scenarios, which can cause the skill to trigger without sufficiently specific user intent. In context, that matters because activation would send search terms and related parameters to an external service, potentially disclosing sensitive research topics or causing unintended API usage/cost.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill does not clearly warn that user-provided keywords, country/language selections, and possibly resulting metadata are transmitted to BrowserAct, an external API service. This lack of transparency can lead users to unknowingly expose confidential queries, competitive research intent, or regulated/sensitive data to a third party.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/google_image_api.py (reported line 15)May include surrounding context.

python

# API Configuration
TEMPLATE_ID = "82307120300629613"
API_BASE_URL = "https://api.browseract.com/v2/workflow"

def run_google_image_task(api_key, keywords, country="us", language="en", scroll_count=5, datelimit=50):
    headers = {"Authorization": f"Bearer {api_key}"}

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This POST request transmits user-controlled query data and authentication material to an external service. While external API use is expected for this skill, the risk is real because search terms may include sensitive business intelligence, personal data, or research topics, and the transfer occurs without safeguards such as disclosure, validation, or consent gating.

Content

Scanner excerpt · scripts/google_image_api.py (reported line 33)May include surrounding context.

python

# 1. Start Task
    print(f"Start Task", flush=True)
    try:
        res = requests.post(f"{API_BASE_URL}/run-task-by-template", json=payload, headers=headers).json()
    except Exception as e:
        print(f"Error: Connection to API failed - {e}", flush=True)
        return None

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script sends user-supplied search keywords, country, language, and task parameters to BrowserAct, an external third-party API, without any explicit disclosure at the point of collection or transmission. In an agent skill context, users may assume processing is local, so undisclosed external transfer of potentially sensitive search terms creates a privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script tells the user to 'Provide it to me or set it as an environment variable,' which encourages disclosure of a secret directly in conversation or plain input. In an agent setting, this increases the chance that API keys are exposed in chat logs, tool traces, prompts, or other retention systems.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The function defaults the language parameter to "en", which establishes a specific language preference automatically. While the CLI allows override, the default still imposes an English locale choice rather than prompting the user or documenting a justified locale restriction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

Reading API keys from environment variables is expected, but this file lacks a docstring or comment near the access explaining that it consumes a sensitive credential for external API authentication. The later error message helps when the key is missing, but it does not serve as advance disclosure of sensitive environment access during normal execution.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.