Security audit

Google SERP Scholar Profiles API

Security checks for vulnerabilities and agentic risk

Overview

This is a focused Just Serp API wrapper with disclosed network and API-key use, but users should be aware the documented command passes the API key as a process argument.

Install only if you intend to send Google Scholar profile searches to Just Serp API using your own key. Prefer a revised version that reads JUST_SERP_API_KEY directly from the environment instead of passing it with --api-key, especially on shared machines, CI, or monitored environments.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: bin/run.mjs:155
Finding: API Key Exposure Through Command-Line Arguments
Content: View full analysis
"}' ``` `SKILL.md:51`: ```markdown - Pass the API key with `--api-key "$JUST_SERP_API_KEY"`; do not paste key values into chat messages, screenshots, or logs. ``` ### Technical Analysis The helper requires the Just Serp API key to be supplied using the `--api-key` command-line option. Although the documentation references an environment variable, the shell expands `$JUST_SERP_API_KEY` before launching Node.js, placing the resulting secret directly in the child process argument vector. Command-line arguments may be observable through process inspection facilities, process-monitoring software, diagnostic tooling, CI/CD command tracing, endpoint telemetry, crash reports, or process-launch audit records. The documentation warning against pasting the key into logs does not prevent these indirect disclosure channels. The key is subsequently used as the `X-API-Key` header for requests to `https://api.justserpapi.com`. The network transmission itself uses HTTPS and no evidence of transmission to an un ...[truncated 1453 chars]
Remediation: View remediation
"}' ``` 5. Where environment inheritance is unsuitable, accept credentials through protected standard input or a credential file restricted to the owning user. 6. Ensure error messages, debug output, telemetry, and request logging redact `X-API-Key`. 7. Rotate any credential that may already have been exposed through shell history, process telemetry, CI logs, or monitoring records. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill invokes a network-capable helper (node {baseDir}/bin/run.mjs) to call an external API, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates a policy gap: an agent or platform may permit broader network access than intended, making it harder to constrain or audit outbound requests and increasing the risk of misuse if the skill is repurposed or modified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code constructs an outbound HTTP request containing the user-provided search parameters and an X-API-Key header, then sends it to an external service. While failures are reported, there is no confirmation prompt, user-facing notice, or comment/docstring warning that data and credentials will be transmitted off-system.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.