Security audit

Google SERP News Search API

Security checks for vulnerabilities and agentic risk

Overview

This skill is a focused Google News search API wrapper, but its documented API-key handling can expose the key through local process arguments.

Review this before installing if you use a valuable Just Serp API key. Prefer a version that reads JUST_SERP_API_KEY directly from the process environment rather than from --api-key, and rotate the key if it may have been exposed through shell history, process monitoring, or logs. The inspected artifacts do not show hidden exfiltration or persistence.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: bin/run.mjs:122
Finding: API Key Exposed Through Command-Line Arguments
Content: View full analysis
"}' ``` `SKILL.md:55` repeats this credential transport mechanism: ```markdown - Pass the API key with `--api-key "$JUST_SERP_API_KEY"`; do not paste key values into chat messages, screenshots, or logs. ``` `bin/run.mjs:122-138` consumes that argument and sends it as an authentication header: ```javascript if (!args.apiKey) { fail("Missing required --api-key argument."); } const params = parseParams(args.paramsJson); applyDefaults(operation, params); validateRequired(operation, params); const baseUrl = manifest.baseUrl; const url = new URL(operation.path, ensureBaseUrl(baseUrl)); applyPathParams(operation, params, url); applyQueryParams(operation, params, url); const requestInit = { headers: { "accept": "application/json", "X-API-Key": args.apiKey, ``` `bin/run.mjs:191-208` parses the secret directly from the process arguments: ```javascript function parseArgs(argv) { const parsed = { apiKey: null, operation: null, paramsJson: "{}" }; for (let index = 0; index < argv.length; index += 1) { const flag = argv[index]; const value = argv[index + 1]; if (flag === "--operation") { parsed.operation = value; index += 1; continue; } if (flag === "--params-json") { parsed.paramsJson = value; index += 1; continue; } if (flag === "--api-key") { parsed.apiKey = value; index += 1; ``` ### Technical Analysis The shell expands `$JUST_SERP_API_KEY` before launching Node.js, placing the resulting credential in the process argument vector. Depending o ...[truncated 2219 chars]
Remediation: View remediation
"}' ``` If the variable is already exported, omit the redundant assignment: ```bash node {baseDir}/bin/run.mjs \ --operation "newsSearch" \ --params-json '{"query":""}' ``` 4. Never include the key in stdout, stderr, backend error payloads, debug output, or exception diagnostics. 5. Document credential rotation and revocation procedures. Rotate any key suspected of having been exposed through process telemetry. 6. Where available, use a restricted credential provider or protected standard-input mechanism instead of command-line arguments. Scope the API key to only the endpoints and quota required by this Skill. ]]>

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill invokes a network-capable helper (node {baseDir}/bin/run.mjs) and makes outbound API requests, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates a policy gap where the agent may use broader capabilities than reviewers or runtime policy expect, increasing the risk of unintended external data exfiltration or unauthorized network access.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.