Security audit

AI Brand Analyzer

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent, but it saves AI-generated web research for reuse in other workflows without enough validation or overwrite safeguards.

Install only if you are comfortable sending brand names and prompts to Gemini and Google Search, and review generated profiles before using them in other AI workflows. Prefer GEMINI_API_KEY over --api-key, avoid confidential unreleased brands, pin dependencies before production use, and back up or review catalog files before using --auto-save.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: scripts/analyze.py:292
Finding: Indirect prompt injection through untrusted search content
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/analyze.py:3
Finding: Unpinned runtime dependency creates a supply-chain exposure
Content: View full analysis
=3.10" # dependencies = [ # "google-genai>=1.0.0", # ] # /// ``` The documented invocation causes `uv` to resolve the inline dependency at runtime: ```bash GEMINI_API_KEY="$KEY" uv run {baseDir}/scripts/analyze.py \ --brand "Brand Name" \ --output ./brands/Brand_Name.json ``` ### Technical Analysis The dependency declaration accepts any `google-genai` release at or above version `1.0.0`. The project contains no lockfile, exact version constraint, or integrity hash that would make dependency resolution reproducible. When the documented `uv run` command is used, a future version may be downloaded and imported without that version having been reviewed with the Skill. Python package initialization code executes with the same operating-system privileges and environment access as the analyzer. The package name itself does not exhibit evidence of typosquatting, and no currently malicious package was identified. The vulnerability is the unsafe, open-ended supply-chain policy: the effective executable code can change after the Skill has been audited. ### Attack Path 1. A new package version satisfying `google-genai>=1.0.0` is published. 2. The release is malicious, compromised, or otherwise contains exploitable initialization behavior. 3. A user executes the documented `uv run` command in an environment where that release is selected. 4. `uv` downloads and installs the newly resolved package. 5. The analyzer imports `google.genai`. 6. Package code executes with the user's privileges and can access the process environment, including `GEMINI_API_KEY`. ### Impact Assessment The maximum impact is equivalent to arbitrary Python execution under the account invoking the Skill. Depending on that account's permissions, a c ...[truncated 442 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/analyze.py:381
Finding: Gemini API key can be exposed through command-line arguments
Content: View full analysis
str | None: """Get API key from argument, env var, or fail.""" if provided_key: return provided_key return os.environ.get("GEMINI_API_KEY") ``` ### Technical Analysis Command-line arguments are not an appropriate secret-transport mechanism on many systems. A key supplied as `--api-key VALUE` may be exposed through: - Shell history. - Process-listing utilities. - `/proc` process metadata on applicable operating systems. - Job-runner and orchestration logs. - Terminal-session recording. - Diagnostic or monitoring telemetry. Although the environment-variable alternative is available and the documentation primarily demonstrates it, the explicit command-line option encourages a credential-handling path that can disclose the key outside the process. ### Attack Path 1. A user invokes the analyzer with `--api-key` followed by a valid Gemini API key. 2. The shell records the complete command in history, or another local process reads the process command line while the analyzer is running. 3. An unauthorized user or logging system obtains the key. 4. The exposed key is used to make Gemini API requests under the victim's account and quota. ### Impact Assessment An attacker obtaining the key may gain access to the Gemini API permissions associated with that credential. Potential consequences include: - Unauthorized API use and quota consumption. - Financial charges where billing is enabled. - Access to API capabilities enabled for the key. - Service disruption through quota exhaustion. This issue does not itself expose unrelated system ...[truncated 118 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/analyze.py:350
Finding: Predictable debug file permits symlink-based file overwrite
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented behavior does not fully match the actual behavior: it omits explicit disclosure of external network access to Gemini and Google Search, while also claiming list/update capabilities not represented here. Undisclosed network egress is security-relevant because brand names, prompts, and potentially sensitive workflow context may be sent to third-party services without clear user awareness or policy gating.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/analyze.py (reported line 304)May include surrounding context.
python
def get_api_key(provided_key: str | None) -> str | None: """Get API key from argument, env var, or fail.""" if provided_key: return provided_key return os.environ.get("GEMINI_API_KEY")

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill documents capabilities that rely on environment-variable access and writing files, but it declares no explicit tool scope or permissions boundary. That creates a least-privilege failure: an agent or reviewer cannot clearly constrain or audit what the skill is allowed to access, increasing the risk of unintended secret exposure or filesystem modification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script sends the user-provided brand name and related research prompts to Google Gemini with Google Search enabled, but it provides no explicit notice or consent flow warning that input data will be transmitted to external Google services. In a creative workflow this can expose confidential client, stealth-brand, or embargoed campaign information to third-party processing, creating a real privacy and data-governance issue even though the behavior appears intended for normal operation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill promotes automatic saving into a fixed catalog path but provides no warning about overwriting existing files or modifying shared brand-profile data. In a multi-workflow environment, this can cause accidental data loss, integrity issues, or poisoning of downstream creative workflows that trust the stored profile.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.