Security audit

Keyapi Google

Security checks across malware telemetry and agentic risk

Overview

This skill does what it says: it uses a KeyAPI token to make Google-related API requests, with clear credential-handling caveats.

Install only if you are comfortable using KeyAPI for Google data retrieval and storing a KeyAPI token in your shell profile. Prefer a private terminal, avoid the --token argument on shared systems, rotate the token if it is exposed, and do not pass sensitive text, URLs, files, or images unless you intend to send them to KeyAPI.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The script reads KEYAPI_TOKEN not only from the current process environment but also by inspecting the user's shell profile files and extracting a managed block. Accessing local profile files expands the skill's reach into user secrets beyond explicit runtime inputs, which is sensitive behavior even if the goal is convenience. In this skill context, the token is immediately used to authenticate outbound API calls, so unintended secret use is plausible.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The script collects a sensitive API token interactively and then writes it into the user's shell profile as a plaintext environment-variable assignment, but the prompt and surrounding UX do not clearly warn the user that the secret will be persisted to disk. This can cause users to disclose credentials under the assumption they are only being used for the current session, increasing the risk of later exposure via local file access, backups, dotfile sync, screen sharing, or accidental publication of shell profiles.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The code silently retrieves a sensitive token from the managed shell profile and places it in the Authorization header for external requests. Even though this is expected for API authentication, the lack of user-facing disclosure or consent means the skill can use locally stored credentials without the caller realizing it, which is a real secret-handling risk.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: This code sends user-supplied query parameters, JSON bodies, and optionally base64-encoded image content to https://api.keyapi.ai. Because the skill is specifically designed to broker external Google-related lookups, this behavior is contextually expected, but it still creates a genuine data-exfiltration surface if users pass sensitive text, files, or images without clear warning.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access, suspicious.secret_argv_exposure

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/keyapi-api.mjs:127

Instructions pass high-value credentials through process argv.

Critical

Code: suspicious.secret_argv_exposure
Location: references/setup-and-auth.md:42