A google search powered by scrapingdog

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:14 AM UTC
• Version: 1.0.2

Overview

This is a straightforward Google-search helper that uses ScrapingDog, with ordinary privacy and dependency cautions but no artifact-backed malicious behavior.

Install only if you are comfortable sending search queries to ScrapingDog/Google and providing a ScrapingDog API key. Use a dedicated key with limits, avoid searching secrets or confidential text, and install dependencies in a virtual environment or from a pinned requirements file. The current CLI also appears to have a bug around --results that should be fixed before relying on it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/search.py:15

Finding

API Credential Transmitted in URL Query Parameters

Content

View full analysis

&query=&... ``` HTTPS protects the request from passive interception while it is in transit, but it does not prevent the complete URL from being recorded at endpoints or intermediary infrastructure. Query strings may be retained in reverse-proxy logs, API access logs, application-performance monitoring systems, HTTP debugging traces, exception telemetry, or other observability platforms. Exploitation requires access to infrastructure or diagnostic records containing the outgoing request URL. The script does not directly print the constructed URL, so this is not an unconditional disclosure to ordinary console users. ### Attack Path 1. A user runs the search Skill with a valid `SCRAPINGDOG_API_KEY`. 2. The script serializes the API credential into the URL query string. 3. A proxy, monitori ...[truncated 778 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: SKILL.md:27

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Remediation

View remediation

``` 2. Generate and require cryptographic hashes for all direct and transitive dependencies, for example: ```bash pip install --require-hashes -r requirements.txt ``` 3. Generate the lock file through a controlled dependency-review process and update it through reviewed changes. 4. Install packages from an explicitly trusted package index and review `pip` configuration for unauthorized additional indexes. 5. Perform installation inside a dedicated virtual environment without administrative privileges. 6. Regularly scan the locked dependency set for known vulnerabilities and update reviewed pins when security fixes are released. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tainted flow: 'params' from os.environ.get (line 27, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/search.py (reported line 37)May include surrounding context.

python

"domain": "google.com",
    }
    try:
        response = requests.get(API_URL, params=params, timeout=30)
        response.raise_for_status()
        return response.json()
    except requests.exceptions.HTTPError:

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The overall purpose of the code matches the description in that it targets Google search through the ScrapingDog API and requires SCRAPINGDOG_API_KEY. However, there is a material behavior mismatch: main() calls search(args.query, args.results, args.country, args.language), but the parser definition for --results is commented out. As a result, args.results does not exist and the script will raise an AttributeError before completing a search. The usage text and declared purpose imply a working search CLI, including support for specifying result count, but the supplied code chunk does not reliably provide that functionality.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trigger text is extremely broad, telling the agent to use this skill for essentially any web lookup even when the user does not explicitly request it. That can cause over-invocation of a networked third-party search skill, increasing unnecessary data sharing and making prompt-routing easier to manipulate.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares environment and network capabilities but does not define an explicit tool scope such as permissions or allowed-tools. In an agent setting, this weakens policy boundaries and can allow broader-than-expected execution or data egress, especially since the skill sends user queries to an external API and reads a secret from the environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The markdown does not warn that user queries are transmitted to a third-party API provider. This creates a privacy and data-handling risk because users or orchestrators may pass sensitive prompts, identifiers, or proprietary text into the skill without informed consent or minimization.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module docstring explicitly documents --results as a supported option, but the corresponding argparse definition is commented out later in the file while main() still calls search(args.query, args.results, ...). This is an active contradiction between the documented interface and the implemented behavior, causing the script to fail rather than behave as documented.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search.py (reported line 18)May include surrounding context.

python

import requests

API_KEY = os.environ.get("SCRAPINGDOG_API_KEY")
API_URL = "https://api.scrapingdog.com/google"


def search(query, results=10, country="us", language="en"):

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This script sends the user's search query and the API credential to a third-party service, but the CLI interface does not clearly warn users that their input leaves the local environment. In an agent-skill context, that matters because users may assume a simple local 'search' action is privacy-neutral when it actually discloses potentially sensitive prompts to an external provider.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The argparse epilog includes an example using --results 5, reinforcing that the flag is part of the intended interface. However, the parser definition for --results is commented out, so the example contradicts actual behavior and misrepresents the skill's operation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The search function sets language="en" by default, and the CLI also defaults --lang to en. This imposes a specific language setting unless the user overrides it, which can violate language/locale policy when no opt-in or justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The command-line interface advertises English as the default language code, reinforcing a fixed locale choice in the user-facing behavior. There is no documented opt-in, language selection step, or justification for restricting default behavior to English.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.