Gemini Web Search

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:56 AM UTC
• Version: 1.0.0

Overview

The skill’s web-search purpose is coherent, but it includes an unsafe shell wrapper that can turn prompt text into local command execution.

Review before installing. Use this only for non-sensitive web-search prompts, and avoid the bundled shell wrapper until it is changed to pass Gemini arguments without shell interpretation. Be aware it may use an existing local Gemini login/session.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/gemini_prompt.sh:7

Finding

Arbitrary Command Execution Through Shell Command Injection

Content

View full analysis

Vulnerability Details

File Location: scripts/gemini_prompt.sh, lines 7–17
Vulnerability Type: Shell command injection through untrusted prompt and executable-path interpolation
Risk Level: High

Vulnerable Code

bash

PROMPT=${1:-}
if [[ -z "${PROMPT}" ]]; then
  echo "Usage: $0 \"<prompt>\"" >&2
  exit 2
fi

GEMINI_BIN="${GEMINI_BIN:-$HOME/.npm-global/bin/gemini}"

# 'script' allocates a pseudo-terminal; /dev/null avoids creating a typescript file.
script -q -c "${GEMINI_BIN} -p \"${PROMPT//\"/\\\"}\"" /dev/null

Technical Analysis

The script constructs a single command string from GEMINI_BIN and PROMPT, then passes it to script -c. The script utility invokes a shell to interpret that string. Consequently, prompt content is parsed as shell syntax rather than being passed directly to Gemini as an opaque argument.

The attempted sanitization only escapes double-quote characters. It does not neutralize command substitutions such as $() or backticks, nor other shell metacharacters and expansions. Although variable contents are not recursively evaluated during the first shell's parameter expansion, the resulting string is parsed again by the shell launched through script -c, at which point injected shell constructs are executed.

GEMINI_BIN is also taken from the caller-controlled environment and inserted into the same command string without validation or shell-safe quoting. An attacker able to influence this variable can inject commands independently of the prompt.

Attack Path

1. The victim or an Agent invokes gemini_prompt.sh with attacker-controlled text, such as content copied from an untrusted request.
2. The text contains shell command substitution, for example a prompt containing $(malicious-command).
3. The script escapes only embedded double quotes and concatenates the prompt into the argument supplied to script -c.
4. script launches a she ...[truncated 1342 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not interpolate prompts or executable paths into a command string interpreted by a shell. Pass the Gemini executable and prompt as distinct arguments through an interface that does not perform shell parsing.
2. If pseudo-terminal allocation is mandatory, use a PTY mechanism that accepts an argument array rather than a single -c command string. A small Python wrapper using the standard pty and os.execv or os.execve APIs is one suitable approach.
3. Pin GEMINI_BIN to a trusted, absolute executable path. If configurability is required, validate the configured value as a single existing executable file and never interpret it as shell syntax.
4. If retaining script -c is unavoidable, generate a command from individually shell-quoted arguments using a robust mechanism such as Bash printf '%q'. Apply quoting separately to both the executable path and prompt. This is less preferable than eliminating the second shell entirely.
5. Add regression tests using prompts containing $(), backticks, semicolons, quotes, newlines, redirections, and pipe characters. Verify that each value reaches Gemini literally and causes no local side effects.
6. Update the command templates in SKILL.md so users are not encouraged to place untrusted prompt text directly into shell-interpreted command strings.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger guidance is broad enough to match many generic requests for current information, such as 'what’s the latest news' or 'find sources/links', which can cause this skill to be invoked in situations where a narrower or safer tool would be more appropriate. Over-broad invocation increases the chance of unnecessary external web access, unintended data exposure in prompts, and use of an authenticated local CLI without strong scoping.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.