ClawHub
Back to skill

Security audit

Gemini Deep Research

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Gemini Deep Research client with expected cloud API use and local report output, but users should handle API keys and saved research files carefully.

Install only if you are comfortable sending research prompts to Google's Gemini API and saving the resulting report plus full JSON metadata locally. Prefer GEMINI_API_KEY over the --api-key command-line option, use a restricted API key, and choose an output directory appropriate for sensitive research topics.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/deep_research.py:112
Finding

Gemini API Key Exposure Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: scripts/deep_research.py, lines 112 and 118
Vulnerability Type: Sensitive credential exposure through process arguments
Risk Level: Medium

Complete Code Snippet

python
parser.add_argument("--api-key", help="Gemini API key (overrides GEMINI_API_KEY env var)")

args = parser.parse_args()

# Get API key
api_key = args.api_key or os.environ.get("GEMINI_API_KEY")

Technical Analysis

The script permits users to supply a Gemini API key through the --api-key command-line argument. Command-line arguments are not an appropriate secret-transport mechanism because they can be recorded in shell history, captured by process-monitoring or observability software, included in diagnostic logs, and potentially viewed through operating-system process inspection.

The script otherwise sends the key as an authentication header over HTTPS to a fixed official Google API endpoint. The vulnerability concerns local exposure before or during execution, not plaintext network transmission or transmission to an unrelated destination.

Attack Path

  1. A user runs the script with a command such as:
    bash
    python scripts/deep_research.py --query "research topic" --api-key "SECRET"
  2. The complete invocation is retained in shell history, process telemetry, job-runner logs, or an operating-system process listing.
  3. A local user, monitoring agent, log reader, or other process with access to that data retrieves the API key.
  4. The exposed key is reused against Gemini API services until it is revoked or restricted.

Impact Assessment

An attacker who recovers the key may consume the associated API quota, generate charges where billing applies, impersonate the authorized client, and access API resources permitted by the key's configuration. This issue does not independently grant local privilege escalation or unrestricted system access. Its scope is bounded by ...[truncated 87 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the --api-key option and obtain the credential from GEMINI_API_KEY, an operating-system secret store, or a protected credential file.
  2. For interactive use, support secret input through getpass.getpass() or standard input without echoing the value.
  3. If command-line compatibility must temporarily remain, emit a prominent security warning and mark the option as deprecated.
  4. Ensure surrounding automation does not print environment variables, request headers, or secret-bearing command lines.
  5. Apply server-side API-key restrictions, quota limits, and least-privilege controls.
  6. Rotate any key that has previously been passed on the command line and remove affected entries from shell histories and execution logs.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)

Tainted flow: 'interaction_id' from os.environ.get (line 139, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/deep_research.py (reported line 63)May include surrounding context.

python
}
    
    while True:
        response = requests.get(
            f"{API_BASE}/interactions/{interaction_id}",
            headers=headers
        )

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The description is written entirely in Chinese ("Gemini 深度研究技能"), which indicates a language-specific presentation without any accompanying note that users can choose another language or locale. Under the policy, language constraints should be optional or clearly justified to avoid imposing a locale on users by default.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/deep_research.py (reported line 42)May include surrounding context.

python
"file_search_store_names": [file_search_store]
        }]
    
    response = requests.post(
        f"{API_BASE}/interactions",
        headers=headers,
        json=payload

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script transmits the user’s research query, and optionally references a file search store, to a third-party cloud API without a clear upfront disclosure at execution time. In environments where prompts or indexed files may contain sensitive internal data, this can lead to unintended external disclosure by users who do not realize where their input is being sent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The file presents key user-facing instructions in both Chinese and English, but it does not tell users what language the skill will use for prompts, outputs, or interaction. This can create a language/locale policy issue when a skill implicitly imposes or defaults to a language without explicit user opt-in or justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill explicitly states that it writes a markdown report and a JSON file containing full interaction metadata, but the description does not warn users about local file creation or potential persistence of sensitive prompts, results, or metadata. This can lead to unintentional disclosure of sensitive research topics or collected data, especially on shared systems or when users assume the skill is ephemeral.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The script automatically writes both the generated report and the full API response to local disk, potentially including sensitive prompts, outputs, metadata, or retrieved content, without prominently warning the user. On shared systems or when output directories are synced or monitored, this can create unintended local data exposure.

Content

No source excerpt is available for this finding.