Gemini Deep Research

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:48 AM UTC
• Version: 2.0.0

Overview

This skill is a straightforward Gemini Deep Research client with expected cloud API use and local report output, but users should handle API keys and saved research files carefully.

Install only if you are comfortable sending research prompts to Google's Gemini API and saving the resulting report plus full JSON metadata locally. Prefer GEMINI_API_KEY over the --api-key command-line option, use a restricted API key, and choose an output directory appropriate for sensitive research topics.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/deep_research.py:112
• Finding: Gemini API Key Exposure Through Command-Line Arguments## Vulnerability Details **File Location**: `scripts/deep_research.py`, lines 112 and 118 **Vulnerability Type**: Sensitive credential exposure through process arguments **Risk Level**: Medium ### Complete Code Snippet ```python parser.add_argument("--api-key", help="Gemini API key (overrides GEMINI_API_KEY env var)") args = parser.parse_args() # Get API key api_key = args.api_key or os.environ.get("GEMINI_API_KEY") ``` ### Technical Analysis The script permits users to supply a Gemini API key through the `--api-key` command-line argument. Command-line arguments are not an appropriate secret-transport mechanism because they can be recorded in shell history, captured by process-monitoring or observability software, included in diagnostic logs, and potentially viewed through operating-system process inspection. The script otherwise sends the key as an authentication header over HTTPS to a fixed official Google API endpoint. The vulnerability concerns local exposure before or during execution, not plaintext network transmission or transmission to an unrelated destination. ### Attack Path 1. A user runs the script with a command such as: ```bash python scripts/deep_research.py --query "research topic" --api-key "SECRET" ``` 2. The complete invocation is retained in shell history, process telemetry, job-runner logs, or an operating-system process listing. 3. A local user, monitoring agent, log reader, or other process with access to that data retrieves the API key. 4. The exposed key is reused against Gemini API services until it is revoked or restricted. ### Impact Assessment An attacker who recovers the key may consume the associated API quota, generate charges where billing applies, impersonate the authorized client, and access API resources permitted by the key's configuration. This issue does not independently grant local privilege escalation or unrestricted system access. Its scope is bounded by ...[truncated 87 chars]
• Remediation: ## Remediation Suggestions 1. Remove the `--api-key` option and obtain the credential from `GEMINI_API_KEY`, an operating-system secret store, or a protected credential file. 2. For interactive use, support secret input through `getpass.getpass()` or standard input without echoing the value. 3. If command-line compatibility must temporarily remain, emit a prominent security warning and mark the option as deprecated. 4. Ensure surrounding automation does not print environment variables, request headers, or secret-bearing command lines. 5. Apply server-side API-key restrictions, quota limits, and least-privilege controls. 6. Rotate any key that has previously been passed on the command line and remove affected entries from shell histories and execution logs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Tainted flow: 'interaction_id' from os.environ.get (line 139, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow

Content

}
    
    while True:
        response = requests.get(
            f"{API_BASE}/interactions/{interaction_id}",
            headers=headers
        )

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: The description is written entirely in Chinese ("Gemini 深度研究技能"), which indicates a language-specific presentation without any accompanying note that users can choose another language or locale. Under the policy, language constraints should be optional or clearly justified to avoid imposing a locale on users by default.

External Transmission

Medium

• Category: Data Exfiltration

Content

"file_search_store_names": [file_search_store]
        }]
    
    response = requests.post(
        f"{API_BASE}/interactions",
        headers=headers,
        json=payload

• Confidence: 80% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script transmits the user’s research query, and optionally references a file search store, to a third-party cloud API without a clear upfront disclosure at execution time. In environments where prompts or indexed files may contain sensitive internal data, this can lead to unintended external disclosure by users who do not realize where their input is being sent.

Natural-Language Policy Violations

Low

• Confidence: 77% confidence
• Finding: The file presents key user-facing instructions in both Chinese and English, but it does not tell users what language the skill will use for prompts, outputs, or interaction. This can create a language/locale policy issue when a skill implicitly imposes or defaults to a language without explicit user opt-in or justification.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The skill explicitly states that it writes a markdown report and a JSON file containing full interaction metadata, but the description does not warn users about local file creation or potential persistence of sensitive prompts, results, or metadata. This can lead to unintentional disclosure of sensitive research topics or collected data, especially on shared systems or when users assume the skill is ephemeral.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The script automatically writes both the generated report and the full API response to local disk, potentially including sensitive prompts, outputs, metadata, or retrieved content, without prominently warning the user. On shared systems or when output directories are synced or monitored, this can create unintended local data exposure.

Static analysis

No suspicious patterns detected.