Gemini Deep Research 1.0.0

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 11:40 PM UTC
• Version: 1.0.0

Overview

This is a straightforward Gemini Deep Research helper that uses the documented Google API and saves local reports, but users should avoid sending sensitive material unless approved.

Install only if you are comfortable sending research prompts and any referenced file-search context to Google Gemini. Prefer GEMINI_API_KEY over --api-key, avoid secrets or regulated data in queries, choose an output directory outside shared repositories when needed, and review or delete the generated JSON metadata after use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/deep_research.py:118

Finding

Gemini API Key Exposed Through Command-Line Arguments

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/deep_research.py:43

Finding

Gemini API Requests Can Block Indefinitely Due to Missing Timeouts

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tainted flow: 'interaction_id' from os.environ.get (line 139, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/deep_research.py (reported line 63)May include surrounding context.

python

}
    
    while True:
        response = requests.get(
            f"{API_BASE}/interactions/{interaction_id}",
            headers=headers
        )

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill advertises capabilities that involve environment-variable access, network access, and file writing, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates a trust and governance gap: callers cannot easily constrain or review what resources the skill is expected to use, increasing the chance of over-broad execution in environments where such declarations are relied upon for policy enforcement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs users to send queries to an external Gemini API endpoint and optionally compare against a file-search store, but it does not clearly warn that user prompts and referenced data may be transmitted to third-party services. In a research skill, users are especially likely to submit internal strategy, market, or financial material, so the lack of an explicit privacy notice raises meaningful risk of unintended data exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation states that final reports and full interaction metadata are saved to timestamped files, but it does not warn that those files may contain sensitive prompts, research targets, internal context, or externally retrieved data. Persisting such material without an explicit privacy warning or retention guidance can lead to accidental local disclosure, inclusion in backups, or later exfiltration from the workstation or repository.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 82% confidence

Finding

The script transmits user-supplied research queries, optional formatting instructions, and potentially file_search_store references to an external Google API. In this skill context, that behavior is expected, but it can still expose sensitive prompts, internal data references, or confidential research topics to a third party if users pass secrets or proprietary material.

Content

Scanner excerpt · scripts/deep_research.py (reported line 42)May include surrounding context.

python

"file_search_store_names": [file_search_store]
        }]
    
    response = requests.post(
        f"{API_BASE}/interactions",
        headers=headers,
        json=payload

Static analysis

No suspicious patterns detected.