Google SERP Trends Trending Now API

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:18 AM UTC
• Version: 1.0.0

Overview

The skill appears to do what it says, but it handles the Just Serp API key in a way that can expose it through local process command lines.

Review before installing if you are sensitive to API-key exposure. Prefer a version that reads JUST_SERP_API_KEY directly from the environment instead of requiring --api-key on the command line, and rotate the key if it may have been run in environments with command logging or process monitoring.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:41

Finding

API Key Exposed Through Command-Line Arguments

Content

View full analysis

"}' ``` `bin/run.mjs:81` parses the process argument vector: ```js const args = parseArgs(process.argv.slice(2)); ``` `bin/run.mjs:91-93` requires the command-line API-key value: ```js if (!args.apiKey) { fail("Missing required --api-key argument."); } ``` `bin/run.mjs:101` places that value in the outbound authentication header: ```js "X-API-Key": args.apiKey, ``` The relevant argument parser in `bin/run.mjs:158-181` confirms that the secret is accepted from `--api-key`: ```js function parseArgs(argv) { const parsed = { apiKey: null, operation: null, paramsJson: "{}" }; for (let index = 0; index < argv.length; index += 1) { const flag = argv[index]; const value = argv[index + 1]; if (flag === "--operation") { parsed.operation = value; index += 1; continue; } if (flag === "--params-json") { parsed.paramsJson = value; index += 1; continue; } if (flag === "--api-key") { parsed.apiKey = value; index += 1; continue; } fail(`Unknown argument "${flag}".`); } return parsed; } ``` ### Technical Analysis Although the key originates in the `JUST_SERP_API_KEY` environment variable, the documented shell command expands it into the Node.js process argument vector. Command-line arguments may be exposed through operating-system process inspection facilities, process listings, diagnostic tooling, monitoring agents, shell tracing, or execution telemetry. The outbound request itself uses a fixed HTTPS origin, and no ev ...[truncated 1435 chars]

Remediation

View remediation

"}' ``` If the environment is already configured, the shorter preferred invocation is: ```bash node {baseDir}/bin/run.mjs \ --operation "TrendsTrendingNow" \ --params-json '{"geo":""}' ``` 5. Avoid printing the key in errors or debug logs. Document that shell tracing should be disabled when configuring credentials. 6. Rotate any API key that may previously have been exposed through process listings, telemetry, or command-history recording. ]]>

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill invokes a network-capable helper (node {baseDir}/bin/run.mjs) that can make external API requests, but the manifest does not explicitly declare an allowed tool scope or permissions boundary. This creates a governance gap: platforms or reviewers cannot reliably restrict or audit the skill’s external connectivity, increasing the risk of unintended data egress or misuse if the helper behavior changes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.