T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/search.py:6- Finding
Google API Key Exposure Through Unsanitized HTTP Error Output
- Content
View full analysis
- Remediation
View remediation
Security audit
Google Search Nino
Security checks for vulnerabilities and agentic risk
Overview
This Google Search skill does what it claims, but its error handling and example usage can expose Google API credentials in logs or command history.
Review before installing. Use a tightly restricted Google API key for Custom Search only, avoid putting real keys directly in shell commands, and prefer updating the script to redact request URLs and report sanitized HTTP errors before using it in logged or shared agent sessions.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill declares capabilities that require access to environment variables and the network, but it does not specify any explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and can allow the skill to run with broader access than users or hosting frameworks may expect, which is especially relevant because it handles API credentials and performs outbound requests.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The example usage places API credentials directly on the command line, which can expose secrets through shell history, process listings, logs, and screenshots. Because this is documentation intended to be copied by users, it creates a realistic pathway for accidental credential leakage even if the underlying code is otherwise legitimate.
- Content