ClawHub
Back to skill

Security audit

Gemini Web MCP

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Gemini Web integration with sensitive account and cookie capabilities, but its instructions mostly keep those capabilities user-directed and scoped.

Install this only if you are comfortable connecting an agent to Gemini Web, sending selected content to Gemini, and optionally granting access to Gemini session cookies and account data. Prefer narrow tool profiles, avoid GEMINI_TOOLS=all for normal work, approve browser cookie export only when needed, and review the MCP server package/source before using uvx-based runtime setup.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Rp1

Medium
Category
MCP Rug Pull
Confidence
84% confidence
Finding

The skill declares use of uvx to obtain and run an external MCP server but does not pin a specific package version or immutable source. That creates a supply-chain risk: a future upstream release, compromise, or typosquatted resolution path could change the executed code without any change to this skill, which is especially relevant here because the skill can handle browser-derived Gemini session cookies and account operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The workflow explicitly enables inspection and mutation of Gemini account data but does not require an explicit user confirmation, sensitivity warning, or stronger guardrails before account-affecting actions. In an agent skill, this omission can cause the agent to access or modify sensitive user data based on ambiguous prompts or over-broad task routing, increasing the risk of privacy violations or unintended account changes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.