Google Web Search

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:45 AM UTC
• Version: 1.0.3

Overview

This skill is a disclosed Gemini-powered web search helper, with expected API-key use and no evidence of hidden persistence, destructive behavior, or credential theft.

Install only in an environment where exposing a Gemini API key is acceptable, preferably with a restricted key. Pin or review dependency versions if reproducible installs matter, and expect user search prompts to be sent to Gemini/Google for grounded answers.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unbounded Third-Party Dependency Installation

Content

View full analysis

=1.50.0 pydantic-settings>=2.0.0 ``` `pyproject.toml:6-9`: ```toml dependencies = [ "google-genai>=1.50.0", "pydantic-settings>=2.0.0", ] ``` `SKILL.md:12-17`: ```json { "id": "python-deps", "kind": "shell", "command": "pip install -r {baseDir}/requirements.txt", "label": "Install Python dependencies (google-genai, pydantic-settings)", } ``` ### Technical Analysis The installation process retrieves packages using lower-bound-only version constraints. No lockfile, exact version constraints, package hashes, or equivalent integrity controls are present. Consequently, a future installation may resolve to dependency versions or transitive dependencies that differ from those reviewed during this audit. The package names correspond to expected public packages, and no evidence of a currently malicious dependency or unsafe package index was found. The risk arises because future releases remain implicitly trusted. If an allowed direct or transitive dependency is compromised, its installation or runtime code could execute within the Skill environment. ### Attack Path 1. An attacker compromises the release process or account of an allowed direct or transitive dependency. 2. The attacker publishes a malicious version satisfying the `>=` constraints. 3. A user or automated Skill installer executes: ```bash pip install -r requirements.txt ``` 4. Pip resolves and downloads the malicious release because no exact lock or trusted hash prevents its selection. 5. Malicious package behavior executes during installation, import, or normal Skill invocation. 6. The payload operates with the permissions of the account or service installing and r ...[truncated 668 chars]

Remediation

View remediation

pydantic-settings== ``` 2. Generate and commit a lockfile that records all transitive dependencies. 3. Use cryptographic package hashes and enforce them during installation: ```bash pip install --require-hashes -r requirements.txt ``` 4. Configure installation to use an explicitly trusted package index and disable unapproved supplemental indexes. 5. Review dependency changes before updating the lockfile, including release provenance, transitive dependency changes, and known vulnerabilities. 6. Run installation and Skill execution in an isolated, least-privileged environment. Expose `GEMINI_API_KEY` only at runtime and restrict the key to the minimum required Gemini API permissions. 7. Add automated dependency scanning and reproducibility checks to the release process. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/example.py (reported line 17)May include surrounding context.

python

class GoogleSearchSettings(BaseSettings):
    """Configuration for the Google Search Tool."""
    model_config = SettingsConfigDict(
        env_file=".env",
        case_sensitive=False,
        extra="ignore"
    )

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/example.py (reported line 21)May include surrounding context.

python

case_sensitive=False,
        extra="ignore"
    )
    # Keys are loaded from environment variables or .env file
    gemini_api_key: str = ""
    gemini_model: str = "gemini-2.5-flash-lite"  # Default model

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/example.py (reported line 39)May include surrounding context.

python

Returns:
        str: The model's grounded response text, including citations metadata.
    """
    # Get API key from environment
    api_key = os.environ.get("GEMINI_API_KEY")
    if not api_key:
        return "ERROR: GEMINI_API_KEY environment variable not set. Cannot ground search."

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill requires access to environment variables, specifically a sensitive credential (GEMINI_API_KEY), but does not declare an explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and makes the credential exposure implicit rather than auditable, increasing the risk of accidental secret access or misuse when the skill is integrated into a larger agent system.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: pydantic-settings has 1 known advisory(ies) (CVE-2026-58203 (pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

The manifest declares pydantic-settings>=2.0.0 without an upper bound or exact pin, and static analysis indicates at least one known advisory exists for this package. Because dependency resolution may install an affected version, the project cannot demonstrate that it avoids the vulnerable range. In this skill, the package is likely used for configuration loading, so exploitation would depend on the application using the vulnerable NestedSecretsSettingsSource path-handling behavior; that makes the issue contextual but still a real supply-chain risk.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency specification uses a lower-bound only constraint (google-genai>=1.50.0), which allows future unreviewed versions to be installed. This weakens build reproducibility and can expose the skill to supply-chain risk if a later release introduces a vulnerability or breaking security-related behavior.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

google-genai>=1.50.0
pydantic-settings>=2.0.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The dependency specification uses pydantic-settings>=2.0.0 without an upper bound or exact pin, so installations may resolve to any future release. In this case the risk is elevated because the package family has a cited advisory, and the unpinned constraint makes it impossible to verify from the manifest whether deployments will select a fixed or affected version.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

google-genai>=1.50.0
pydantic-settings>=2.0.0

Unverifiable Dependency: pydantic-settings has 1 known advisory(ies) (CVE-2026-58203 (pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The manifest includes pydantic-settings without a pinned version even though there is a known advisory affecting some versions. Because the resolved version is not fixed in the file, consumers cannot determine whether they are protected, and a vulnerable install could permit unsafe secret-loading behavior such as following symlinks outside the intended secrets directory.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.