Google SERP Trends Search API

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:18 AM UTC
• Version: 1.0.0

Overview

This is a narrow Google Trends API wrapper, with a real but limited credential-handling caution because it passes the Just Serp API key on the command line.

Install only if you are comfortable sending search terms and filters to Just Serp API. Prefer running it in an environment where other local users or telemetry cannot inspect process arguments, and rotate the Just Serp API key if you believe it may have been exposed through command history, process listings, CI logs, or monitoring tools.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:49

Finding

API Key Exposed Through Process Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:49, SKILL.md:57, bin/run.mjs:129, bin/run.mjs:139-156, and bin/run.mjs:217-227
Vulnerability Type: API credential exposure through process arguments
Risk Level: Medium

The documented invocation expands JUST_SERP_API_KEY into the command line:

bash

node {baseDir}/bin/run.mjs --operation "TrendsSearch" --api-key "$JUST_SERP_API_KEY" --params-json '{"query":"<query>"}'

The accompanying documentation explicitly directs users to pass the credential this way:

markdown

- Required: `JUST_SERP_API_KEY`
- Pass the API key with `--api-key "$JUST_SERP_API_KEY"`; do not paste key values into chat messages, screenshots, or logs.

The executable reads the API key from process.argv and places it into the request header:

javascript

const args = parseArgs(process.argv.slice(2));

if (!args.apiKey) {
  fail("Missing required --api-key argument.");
}

const requestInit = {
  headers: {
    "accept": "application/json",
    "X-API-Key": args.apiKey,
  },
  method: operation.method,
};

The argument parser confirms that the secret is accepted directly as an argument:

javascript

function parseArgs(argv) {
  const parsed = { apiKey: null, operation: null, paramsJson: "{}" };
  for (let index = 0; index < argv.length; index += 1) {
    const flag = argv[index];
    const value = argv[index + 1];
    if (flag === "--operation") {
      parsed.operation = value;
      index += 1;
      continue;
    }
    if (flag === "--params-json") {
      parsed.paramsJson = value;
      index += 1;
      continue;
    }
    if (flag === "--api-key") {
      parsed.apiKey = value;
      index += 1;
      continue;
    }
    fail(`Unknown argument "${flag}".`);
  }
  return parsed;
}

Technical Analysis

Passing a secret through a command-line argument places the expanded cr ...[truncated 1971 chars]

Remediation

View remediation

Remediation Suggestions

1. Read the credential directly from the environment rather than from process.argv:

   javascript

   const apiKey = process.env.JUST_SERP_API_KEY;
   
   if (!apiKey) {
     fail("Missing required JUST_SERP_API_KEY environment variable.");
   }
   
   const requestInit = {
     headers: {
       accept: "application/json",
       "X-API-Key": apiKey,
     },
     method: operation.method,
   };
   

2. Remove --api-key from the documented command and use:

   bash

   JUST_SERP_API_KEY="..." node {baseDir}/bin/run.mjs \
     --operation "TrendsSearch" \
     --params-json '{"query":"<query>"}'
   

   Prefer setting the environment variable through a protected secret manager rather than placing the assignment directly in interactive shell history.

3. Remove or explicitly reject the --api-key argument so callers do not continue using the insecure interface.

4. If environment-based secret injection is unavailable, accept the key through protected standard input or a permission-restricted credential file. Do not echo the value or include it in error output.

5. Configure CI/CD systems and observability agents to redact JUST_SERP_API_KEY, X-API-Key, and equivalent credential fields.

6. Rotate any API key that may previously have been exposed through process listings, command telemetry, shell tracing, or diagnostic logs.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill invokes a network-capable helper (node ... run.mjs) and uses an external API key, but it does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch weakens policy enforcement and reviewability: a host may permit broader execution or networking than intended, and users cannot clearly see that this skill performs outbound requests to a third-party service.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.