Google SERP Finance Search API

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:18 AM UTC
• Version: 1.0.1

Overview

This skill appears to do the finance search it advertises, but it handles the required API key in a way that can expose it locally.

Review before installing. The skill is narrowly aimed at one finance-search API endpoint, but users should prefer a version that reads JUST_SERP_API_KEY directly from the environment or another protected secret channel instead of passing the key as a command-line argument. Also verify that your runtime constrains network access to the Just Serp API endpoint.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: bin/run.mjs:157

Finding

API Key Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:45-51, bin/run.mjs:86-88, bin/run.mjs:157-160
Vulnerability Type: API credential exposure through the process argument vector
Risk Level: Medium

Vulnerable Code

The documented invocation passes the API key as a command-line argument:

bash

node {baseDir}/bin/run.mjs --operation "financeSearch" --api-key "$JUST_SERP_API_KEY" --params-json '{"query":"<query>"}'

The documentation explicitly requires this command-line pattern:

markdown

- Pass the API key with `--api-key "$JUST_SERP_API_KEY"`; do not paste key values into chat messages, screenshots, or logs.

The implementation requires and parses the secret from the process arguments:

js

if (!args.apiKey) {
  fail("Missing required --api-key argument.");
}

js

if (flag === "--api-key") {
  parsed.apiKey = value;
  index += 1;
  continue;
}

Technical Analysis

Although the key originates in an environment variable, the shell expands "$JUST_SERP_API_KEY" before launching Node.js. The resulting secret is therefore placed in the child process's argument vector as the value of --api-key.

Process arguments can be exposed through operating-system process inspection interfaces, administrative monitoring, endpoint telemetry, crash diagnostics, command auditing, or process-management tools. Exposure depends on the host's process isolation and monitoring configuration, but passing credentials through command-line arguments unnecessarily increases their observable surface.

The key is subsequently used as an X-API-Key header for the fixed HTTPS endpoint. No evidence was found that the script intentionally logs the key, sends it to an undeclared destination, or embeds a hardcoded credential.

Attack Path

1. A user follows the documented command and invokes the helper with --api-key "$JUST_SERP_API_KEY".
2. The shell expands JUST_SERP_API_KEY and places its value in the Node.js process argument vector.

...[truncated 988 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the --api-key command-line option and read the credential directly from the environment:

js

const apiKey = process.env.JUST_SERP_API_KEY;

if (!apiKey) {
  fail("Missing required JUST_SERP_API_KEY environment variable.");
}

2. Use the environment-derived value only when constructing the request header:

js

const requestInit = {
  headers: {
    accept: "application/json",
    "X-API-Key": apiKey,
  },
  method: operation.method,
};

3. Update the documented invocation so the secret is not expanded into the command line:

bash

JUST_SERP_API_KEY="$JUST_SERP_API_KEY" \
  node {baseDir}/bin/run.mjs \
  --operation "financeSearch" \
  --params-json '{"query":"<query>"}'

If the variable is already exported, omit the inline assignment entirely.

4. For environments where environment-variable exposure is also considered too broad, support protected standard input or an operating-system secret store. Do not accept the secret in a URL, query string, or ordinary command-line flag.

5. Avoid including the API key in error objects, debug logs, telemetry, or crash reports. Consider redaction controls for both X-API-Key and JUST_SERP_API_KEY.

6. After deploying the fix, rotate any credential that may have been captured in process telemetry or historical command-line records.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill invokes a network-capable helper (node ... run.mjs) and requires an API key, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates a policy/containment gap: an agent or platform may permit broader outbound actions than reviewers expect, making it harder to enforce least privilege and increasing the risk of unintended external requests or data exposure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.