Google Search Grounding 3

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 3:46 PM UTC
• Version: 1.0.0

Overview

This skill appears to do what it says: run Google-backed searches, though users should be careful with the installer and with sensitive search content.

Before installing, assume any search terms and surrounding context passed to the skill may be sent to Google services. Do not use it for secrets, credentials, private customer data, or confidential internal content. Prefer installing the dependency in an isolated virtual environment instead of running the provided installer against the system Python environment, and set --lang/--country or the matching environment variables if the Hebrew/Israel defaults are not appropriate.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: install.sh:7

Finding

Unpinned Dependency Installation into the System Python Environment

Content

View full analysis

Vulnerability Details

File Location: install.sh:7-13
Vulnerability Type: Unpinned third-party dependency and unsafe system-wide package installation
Risk Level: Medium

Complete Code Snippet:

bash

# Install Python dependencies
pip install --break-system-packages --quiet google-genai 2>/dev/null || {
    echo "⚠️  pip install failed, trying without --break-system-packages..."
    pip install --quiet google-genai 2>/dev/null || {
        echo "❌ Failed to install google-genai. Install manually: pip install google-genai"
        exit 1
    }
}

Technical Analysis

The installer retrieves google-genai without an exact version constraint or cryptographic hash verification. Consequently, installation behavior depends on whichever package version and transitive dependencies the package index serves at execution time, rather than on a dependency set covered by this audit.

The first installation attempt also uses --break-system-packages, bypassing Python's externally managed environment safeguard. This can modify the shared system Python environment and interfere with packages used by unrelated applications. Although the package name is consistent with the documented dependency and no typo-squatting or untrusted package index was identified, the dependency installation remains mutable and executes code outside the reviewed project.

Attack Path

1. A user runs bash install.sh.
2. The installer invokes pip against the default package index without a version pin or required hashes.
3. pip resolves the latest available google-genai release and its transitive dependencies.
4. If a future release, distribution artifact, package-index account, or transitive dependency is compromised, malicious installation or runtime code is placed in the Python environment.
5. The malicious code executes with the privileges of the user running the installer or when the Skill subsequently imports th ...[truncated 764 chars]

Remediation

View remediation

Remediation Suggestions

1. Create and use a dedicated virtual environment rather than modifying the system Python installation.
2. Remove the --break-system-packages option.
3. Pin google-genai and all transitive dependencies to reviewed versions in a lock file or requirements file.
4. Require cryptographic hashes, for example with pip install --require-hashes -r requirements.txt.
5. Use an explicitly trusted package index and disable unintended additional indexes where practical.
6. Run dependency vulnerability and provenance checks during release preparation.
7. Update SKILL.md metadata and installation instructions to reference the same pinned dependency set.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill routes user queries to external Google services (Gemini Search Grounding and Custom Search API) but does not clearly warn users that their prompts, search terms, and possibly related context will leave the local environment. This creates a real privacy and data-handling risk, especially if an agent passes sensitive user content, internal project details, or secrets in search queries under the assumption that this is just a local capability.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Defaulting all searches to Hebrew and Israel can silently leak user localization assumptions and bias results toward a specific geography without consent. In a search tool, that can affect privacy, relevance, and fairness by transmitting region/language hints to third-party APIs even when the user did not request them.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.