SerpAPI Search

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:38 AM UTC
• Version: 1.0.0

Overview

This looks like a real SerpAPI search helper, but its API-key handling and shell-script hardening need review before installation.

Install only if you are comfortable sending searches and locations to SerpAPI and storing or providing a SerpAPI key. Prefer SERPAPI_API_KEY over --api-key, avoid running this through privileged wrappers or with untrusted environment variables, and consider patching the script to avoid exposing the key in process arguments and to pass temporary paths safely.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/search.sh:65

Finding

SerpAPI Credential Exposure Through Command-Line Arguments and Request URL

Content

View full analysis

&2; exit 1 ;; esac [[ -n "$LOCATION" ]] && PARAMS="${PARAMS}&location=$(urlencode "$LOCATION")" # Fetch TMPFILE=$(mktemp) trap "rm -f $TMPFILE" EXIT curl -s "https://serpapi.com/search.json?${PARAMS}" > "$TMPFILE" ``` ### Technical Analysis The script permits the SerpAPI key to be supplied with the `--api-key` command-line option. Command-line secrets can be retained in shell history and may be visible to local process-inspection or monitoring mechanisms. Regardless of whether the key originates from the command line, an environment variable, or a configuration file, it is subsequently embedded in the URL passed as a `curl` argument. While HTTPS protects the request in transit, it does not prevent local disclosure through process arguments, diagnostic traces, process-monitoring agents, or command-execution logs. The key grants access to the associated SerpAPI account and quota. It should therefore be treated as sensitive authentication material rather than ordinary request metadata. ### Attack Path 1. A user invokes the script with `--api-key`, or the script obtains a key from the environment or a configuration file. 2. The script places the credential into the `api_key` query parameter. 3. The complete URL containing the credential is supplied as a command-line argument to `curl`. 4. A local user, monitoring ser ...[truncated 619 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/search.sh:71

Finding

Environment-Assisted Code Injection Through Unsafe Temporary Path Interpolation

Content

View full analysis

"$TMPFILE" # Check error ERROR=$(python3 -c "import json;d=json.load(open('$TMPFILE'));print(d.get('error',''))" 2>/dev/null || echo "") ``` ### Technical Analysis `mktemp` can construct its output path under the directory specified by the process environment, commonly through `TMPDIR`. The resulting path is used as executable source text in two places: - It is interpolated into a double-quoted trap command that Bash later evaluates when the process exits. - It is interpolated directly into Python source passed through `python3 -c`. A temporary path containing shell metacharacters can alter the command evaluated by the `EXIT` trap. A path containing a single quote and valid Python syntax can terminate the string literal supplied to `open()` and inject Python statements into the `-c` program. Quoting the variable while constructing an executable command string does not safely encode it for later evaluation. Similarly, interpolating a filename into generated Python source is unsafe because filesystem path characters are not automatically escaped as Python string-literal content. Exploitation requires influence over the script's execution environment, such as control of `TMPDIR`. The security impact becomes significant when the script runs through a privileged wrapper, automation service, or another context whose privileges exceed those of the party controlling the environment. ### Attack Path 1. An attacker creates a writable directory whose path contains characters crafted to form shell syntax or terminate the Python string literal. 2. The attacker sets `TMPDIR` to that directory before the script is launch ...[truncated 1179 chars]

Remediation

View remediation

/dev/null || echo "" ) ``` Additional hardening measures: 1. In privileged execution contexts, unset or validate `TMPDIR` and use a trusted temporary directory. 2. Verify that the selected temporary directory is not attacker-controlled. 3. Never construct shell programs by interpolating filenames into strings that will later be evaluated. 4. Never construct Python source by inserting unescaped filesystem paths; pass values through `sys.argv`, standard input, or environment variables. 5. Retain `mktemp` for unique-file creation and ensure cleanup commands use `--` before the filename. 6. If this script is exposed through a service or privileged wrapper, sanitize inherited environment variables before invoking it. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/search.sh (reported line 44)May include surrounding context.

sh

# Resolve API key
if [[ -z "$API_KEY" ]]; then
  SKILL_ENV="$(dirname "$SCRIPT_DIR")/.env"
  [[ -f "$SKILL_ENV" ]] && API_KEY=$(grep -E "^SERPAPI_API_KEY=" "$SKILL_ENV" 2>/dev/null | cut -d= -f2- || true)
  [[ -z "$API_KEY" && -f "$HOME/.config/serpapi/api_key" ]] && API_KEY=$(cat "$HOME/.config/serpapi/api_key")
fi

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill invokes shell scripts and performs network access but does not declare any explicit tool scope or permission boundary. In agent environments, this can lead to overbroad execution privileges, making the skill harder to sandbox and increasing the blast radius if the skill is misused or modified.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 83% confidence

Finding

The skill instructs users to persist the SerpAPI credential in a long-lived plaintext file under ~/.config/serpapi. Persistent storage of secrets increases exposure to credential theft from local compromise, backup leakage, dotfile syncing, or unintended reuse across sessions.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

Set SERPAPI_API_KEY env var, or store it:

bash

mkdir -p ~/.config/serpapi
echo "your_key_here" > ~/.config/serpapi/api_key
chmod 600 ~/.config/serpapi/api_key

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

bash

mkdir -p ~/.config/serpapi
echo "your_key_here" > ~/.config/serpapi/api_key
chmod 600 ~/.config/serpapi/api_key

Common country codes

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/search.sh (reported line 50)May include surrounding context.

sh

fi

if [[ -z "$API_KEY" ]]; then
  echo "Error: No API key. Set SERPAPI_API_KEY or create ~/.config/serpapi/api_key" >&2
  exit 1
fi

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This shell script performs an outbound HTTP request to a third-party service and transmits the user's search query along with locale parameters and the API key. Although the script comments describe usage, there is no confirmation prompt or user-facing disclosure at execution time that query data is being sent off-system.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The script sets LANG="en" by default, which imposes a specific language preference unless the user explicitly overrides it. Under the stated policy, forcing a specific language without opt-in can be a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The manifest describes a skill for performing SerpAPI web/news/local searches, but this script also implements credential discovery by reading from a sibling .env file and from ~/.config/serpapi/api_key. While using an API key is necessary for search, probing multiple local configuration locations is an additional filesystem access capability not stated in the skill description.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.