Security audit

Phy Content Safety Guard

Security checks for vulnerabilities and agentic risk

Overview

The skill is transparent about using Gemini as a safety judge, but it needs review because it sends full outgoing messages to a third party and defaults to letting messages through when judging fails.

Install only if it is acceptable for eligible outbound chat messages to be sent to Google Gemini. For confidential, child-facing, financial, health, HR, or regulated use, configure fail-closed behavior, add local redaction or deterministic secret checks before remote judging, restrict and rotate the Google API key, and pin any dependency versions.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

other

Error

Location: SKILL.md:149
Finding: Unredacted outbound messages are disclosed to a third-party model provider
Content: View full analysis
controller.abort(), TIMEOUT_MS); const url = `${API_URL}/${GEMINI_MODEL}:generateContent?key=${apiKey}`; try { const response = await fetch(url, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ systemInstruction: { parts: [{ text: GUARD_SYSTEM_PROMPT }], }, contents: [{ role: "user", parts: [{ text: `Evaluate this outbound message:\n\n${messageContent}` }], }], ``` ### Technical Analysis The handler transmits the complete outbound message to the Google Gemini API before determining whether it is safe. No local redaction, data classification, user-consent check, destination allowlist, or sensitive-data suppression is performed. The guard is specifically designed to identify leaked API keys, system prompts, model details, and internal filenames. Consequently, sensitive data that the guard is expected to block is first disclosed to the external model provider. Messages may also contain personal information, confidential business data, regulated records, or proprietary prompts. Third-party model access is relevant to the declared cloud-based classification function, but transmitting the entire message exceeds minimum data privileges when local preprocessing or a self-hosted judge could reduce disclosure. ### Attack Path 1. A user, prompt-injection payload, or compromised upstream agent causes a generated response to contain confidential data. 2. The `message:sending` hook receives the response as `data.content`. 3. The complete content is passed to `evaluateWithGemini`. 4. The handler embeds the content unchanged in ...[truncated 774 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:149
Finding: Google API credential is embedded in the request URL
Content: View full analysis
controller.abort(), TIMEOUT_MS); const url = `${API_URL}/${GEMINI_MODEL}:generateContent?key=${apiKey}`; try { const response = await fetch(url, { ``` ### Technical Analysis The Google API key is interpolated into the URL query string. Although the request uses HTTPS, query strings can be recorded by application-performance monitoring, HTTP tracing, debugging tools, reverse proxies, exception reports, or other URL-level telemetry. A credential in the URL is therefore more likely to be unintentionally persisted than one supplied through an authentication header. The Skill correctly reads the key from an environment variable, but this benefit is weakened when the value is subsequently embedded in a URL. ### Attack Path 1. An operator configures `GOOGLE_GENAI_API_KEY`. 2. The handler constructs a URL containing the plaintext key in its query string. 3. A proxy, tracing service, debugger, monitoring agent, or error-reporting system records the request URL. 4. An attacker or unauthorized user with access to those records extracts the key. 5. The attacker submits requests using the exposed credential until it is revoked, restricted, or exhausted. ### Impact Assessment A recovered key may permit unauthorized consumption of the associated Google API quota and cause financial charges or service exhaustion. The exact scope depends on the key's API, project, referrer, IP, and quota restrictions. This issue does not directly expose host privileges, but compromise of an insufficiently restricted key may grant access to other Google APIs enabled for that credential. ]]>
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:138
Finding: Content safety enforcement fails open when the remote judge is unavailable
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:44
Finding: Dependency installation instruction does not pin an audited version
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill defines fixed English and Chinese fallback messages and later selects Chinese solely by detecting Chinese characters in the outbound content. This imposes a locale policy in natural-language behavior without explicit user opt-in or documentation that the skill is limited to English/Chinese contexts.
Content: No source excerpt is available for this finding.