Google Serper Search

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 5:14 PM UTC
• Version: 0.1.1

Overview

This is a coherent web-search skill, but users should understand it sends search queries to Serper and stores a Serper API key if they follow the persistence instructions.

Install only if you are comfortable sending your search terms to Serper and using a Serper API key. Prefer a per-project or secrets-manager setup for SERPER_API_KEY instead of permanently writing it into shell startup files, and consider pinning or verifying the installer/source before use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:6
• Finding: Unpinned Third-Party Installation Command Creates a Supply-Chain Risk## Vulnerability Details **File Location**: `README.md:6` **Vulnerability Type**: Unpinned third-party executable and mutable Skill source **Risk Level**: Medium **Vulnerable Code:** ```bash npx skills add shuliuzhenhua-sys/google-serper-search ``` ### Technical Analysis The documented installation command invokes the `skills` npm executable through `npx` without specifying a reviewed version. Depending on the local npm environment, `npx` can retrieve and execute the latest available version of that package. The command also identifies the Skill through a mutable repository-style reference rather than an immutable commit, signed release, or verified artifact. Consequently, the code executed or installed when a user follows the documentation can differ from the version covered by this audit. Compromise of the npm package, package maintainer account, upstream Skill repository, or release process could cause users to receive malicious installation logic or modified Skill content. No malicious dependency or active compromise was identified in the audited files. The vulnerability is the absence of version and integrity controls at the documented supply-chain boundary. ### Attack Path 1. An attacker compromises the npm package, its publisher account, the referenced Skill source, or another relevant upstream distribution channel. 2. The attacker publishes a malicious version of the `skills` executable or replaces the mutable Skill content. 3. A user follows the documented `npx skills add shuliuzhenhua-sys/google-serper-search` command. 4. `npx` obtains and executes the unreviewed package version, or the installer obtains the modified Skill. 5. The malicious installer or Skill executes with the invoking user's privileges or is installed into the user's agent environment. 6. The compromised content can then affect installation-time operations or later agent sessions in which the Skill is loaded. ### Impact Assessment Explo ...[truncated 604 chars]
• Remediation: ## Remediation Suggestions 1. Pin the npm CLI to an explicitly reviewed version, for example by using a version-qualified package reference supported by npm. 2. Pin the Skill source to an immutable commit hash or a specific, verified release rather than a mutable repository reference. 3. Publish and verify cryptographic checksums or signatures for distributed artifacts. 4. Commit and enforce an npm lockfile where package-based installation is part of a maintained installation workflow. 5. Use npm provenance and package-signature verification where available. 6. Document the exact expected package version, source revision, checksum, and verification procedure. 7. Advise users not to run the installer with administrative privileges and to review installation scripts before execution. 8. Periodically re-audit pinned dependency updates before changing the documented versions.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (13)

Tainted flow: 'req' from os.environ.get (line 56, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

try:
        req = urllib.request.Request(endpoint, data=data, headers=headers, method="POST")
        with urllib.request.urlopen(req) as response:
            return json.loads(response.read().decode("utf-8"))
    except urllib.error.HTTPError as e:
        return {"error": f"HTTP {e.code}: {e.reason}"}

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match

Content

erper.dev](https://serper.dev) and set it as an environment variable:

```bash
export SERPER_API_KEY="your_api_key"
```

To make it permanent, add it to your shell configuration file:

<thinking>
我需要提供不同 shell 的配置方法。让我列出常见的 shell 配置文件。
</thinking>

- **Zsh**: `echo 'export SERPER_API_KEY="your_api_key"' >> ~/.zshrc && source ~/.zshrc`
- **Bash**: `echo 'export SERPER_API_KEY="your_api_key"' >> ~/.bashrc && source ~/.bashrc`
- **Fish**: `echo 'set -Ux SERPER_API_KEY "your_api_key"' | fish`

## Usage

After installation, simply ask Claude to search for information in your conversation:

**Web Search Examples:**
- "Search for the latest AI news"
- "Find information about Claude Code"
- "What's the current weather in Tokyo?"

**Image Search Examples:**
- "Find pictures of mountains"
- "Search for images of the Eiffel Tower"
- "Show me photos of golden retrievers"

Claude will automatically use this skill when you request web or image search

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The README instructs users to persist an API key in shell startup files without warning about credential exposure, shell history, shared account access, or accidental publication of dotfiles. This increases the risk of long-lived secret leakage beyond the immediate session.

Ssd 1

Medium

• Confidence: 89% confidence
• Finding: Publishing chain-of-thought-style markup such as `<thinking>` can prime downstream models or tools to treat hidden reasoning as acceptable output format, which is risky in prompt-driven systems. In a skill context, this weakens separation between internal reasoning and user-visible instructions and may encourage unsafe prompt patterns.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The activation guidance is very broad, covering many generic phrases like 'search for information' and 'find pictures,' which can cause the skill to trigger in situations broader than intended. In an agent environment, overbroad activation increases the chance of unnecessary external requests and accidental transmission of user queries to a third-party API.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill instructs the agent to execute a Python search script that uses network access and likely reads API credentials from the environment, but the skill metadata declares no explicit tool scope or permissions. This creates an authorization and governance gap: the skill can be invoked without clear restriction on networked/scripted behavior, increasing the chance of unintended data egress or execution in environments that rely on declared scopes for safety review.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrases are very broad, covering nearly any request to 'search for information' or 'find information online,' which can cause over-activation of the skill. In practice this can push the agent to use external network search unnecessarily, exposing user queries to third-party services and bypassing safer/default non-network responses.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The 'When to Use This Skill' section says to use the skill for verification, latest updates, and questions that require web search, but the boundaries are vague and likely to be interpreted expansively. That ambiguity increases unnecessary network use and third-party disclosure of user prompts, especially for requests that could be answered locally or with clarification.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The skill metadata says it should only perform web and image search, but the implementation exposes many additional Serper modes such as maps, places, reviews, shopping, scholar, patents, and news. This capability mismatch can let an agent invoke functionality outside the declared trust boundary, undermining policy controls and potentially enabling unintended data access or actions through a broader external API surface.

Intent-Code Divergence

Low

• Confidence: 95% confidence
• Finding: The embedded `<thinking>` block exposes internal reasoning-like text in the published README. While it does not directly execute code, it leaks author-only drafting content and can normalize inclusion of hidden reasoning artifacts in prompts or skills, which is unsafe documentation practice.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: The README includes visible internal reasoning text in Chinese inside a <thinking> block. This introduces a language-specific instruction artifact without offering user choice or justification, which conflicts with the language/locale neutrality expectation.

Natural-Language Policy Violations

Low

• Confidence: 77% confidence
• Finding: The example command and parameter guidance present `--hl en` as the default language choice, and the document does not instruct the agent to match the user's language or ask for preference. This can conflict with a language or locale policy if the skill defaults to English without user opt-in.

Static analysis

No suspicious patterns detected.