Google SERP Maps Search API

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:19 AM UTC
• Version: 1.0.1

Overview

This skill is a focused API wrapper for Just Serp Google Maps search, with expected network and API-key use but some credential and privacy handling caveats.

Install only if you are comfortable sending Google Maps queries, optional coordinates, place IDs, and related localization parameters to Just Serp API. Prefer rotating or limiting the API key, avoid shell tracing or command logging, and consider modifying the helper to read JUST_SERP_API_KEY directly from the environment instead of passing it with --api-key.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: bin/run.mjs:187

Finding

API Key Exposure Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:48, SKILL.md:55, and bin/run.mjs:116-118, bin/run.mjs:187-204
Vulnerability Type: API credential exposure through the process argument vector
Risk Level: Medium

Vulnerable Code

SKILL.md:48:

bash

node {baseDir}/bin/run.mjs --operation "mapsSearch" --api-key "$JUST_SERP_API_KEY" --params-json '{"query":"<query>"}'

SKILL.md:55:

markdown

- Pass the API key with `--api-key "$JUST_SERP_API_KEY"`; do not paste key values into chat messages, screenshots, or logs.

bin/run.mjs:116-118:

javascript

if (!args.apiKey) {
  fail("Missing required --api-key argument.");
}

bin/run.mjs:187-204:

javascript

function parseArgs(argv) {
  const parsed = { apiKey: null, operation: null, paramsJson: "{}" };
  for (let index = 0; index < argv.length; index += 1) {
    const flag = argv[index];
    const value = argv[index + 1];
    if (flag === "--operation") {
      parsed.operation = value;
      index += 1;
      continue;
    }
    if (flag === "--params-json") {
      parsed.paramsJson = value;
      index += 1;
      continue;
    }
    if (flag === "--api-key") {
      parsed.apiKey = value;
      index += 1;
      continue;
    }

Technical Analysis

The documented invocation expands JUST_SERP_API_KEY into the command line and the helper reads the resulting secret from process.argv. Consequently, the plaintext credential becomes part of the child process's argument vector.

Depending on operating-system permissions and deployment configuration, process arguments may be visible to local users or captured by process-monitoring agents, audit systems, shell tracing, job runners, diagnostic tooling, and command telemetry. Although the helper appropriately transmits the key to the fixed HTTPS endpoint in the X-API-Key header, accepting the credential through argv unnecess ...[truncated 1473 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the --api-key command-line option and read the credential directly from the environment:

   javascript

   const apiKey = process.env.JUST_SERP_API_KEY;
   if (!apiKey) {
     fail("Missing required JUST_SERP_API_KEY environment variable.");
   }
   

2. Use the environment-derived value only when constructing the request header:

   javascript

   const requestInit = {
     headers: {
       accept: "application/json",
       "X-API-Key": apiKey,
     },
     method: operation.method,
   };
   

3. Update SKILL.md so the invocation does not expand the secret into an argument:

   bash

   JUST_SERP_API_KEY="$JUST_SERP_API_KEY" \
     node {baseDir}/bin/run.mjs \
     --operation "mapsSearch" \
     --params-json '{"query":"<query>"}'
   

   If the variable is already exported, omit the inline assignment entirely.

4. If environment-based injection is unavailable, accept the secret through standard input or a permission-restricted credential file rather than through argv.

5. Ensure application logs, shell tracing, CI/CD job output, process telemetry, and error reports never record the API key or request headers.

6. Rotate any credential previously used through the documented command if process arguments may have been collected. Apply server-side expiration, least-privilege scopes, quota limits, and usage monitoring where supported.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill invokes a network-capable helper (node .../run.mjs) and requires an API key, but it does not declare an explicit tool scope such as permissions or allowed-tools. This weakens policy enforcement and reviewability because an agent platform may permit broader-than-intended external access or fail to constrain network use to the expected endpoint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This skill sends user-supplied search terms, optional GPS coordinates, localization settings, and place identifiers to a third-party external API, which can reveal sensitive location intent, physical whereabouts, or business targeting activity. The operation metadata does not include any warning, consent flow, data-minimization guidance, or privacy disclosure, so users or calling agents may transmit sensitive information without realizing it leaves the local trust boundary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This code performs an outbound HTTP request to a third-party API using potentially sensitive user-provided search terms, coordinates, language, and country parameters. While the script structure makes the API-call purpose apparent to a developer, there is no confirmation prompt, print/log disclosure, or inline warning explaining that this data will be sent off-system.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.