Gemini Guide

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 11:33 PM UTC
• Version: 1.0.0

Overview

This is a small Gemini API guide with purpose-aligned examples, but users should be careful before uploading or caching sensitive files with Google’s API.

Before installing or following the examples, use a virtual environment, pin dependencies for production, and avoid sending confidential, personal, proprietary, or regulated files to Gemini uploads or context caches unless you have approval and understand the provider’s retention terms.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:23

Finding

Unpinned Third-Party SDK Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23–25
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

markdown

## SDK 安装与基础调用
```bash
pip install google-genai   # 官方 SDK

text

### Technical Analysis

The documented installation command retrieves the latest available `google-genai` package and its transitive dependencies from the package index configured for `pip`. It provides no exact version constraint, lockfile, or cryptographic hash verification.

Although the package is represented as Google's official SDK and the document does not specify a suspicious package source, the dependency remains mutable after this Skill's review. A future compromised, malicious, or unexpectedly incompatible release could introduce unsafe installation-time or runtime behavior. The risk also depends on whether the user's package-index configuration and network path are trustworthy.

### Attack Path

1. A user follows the installation instructions.
2. `pip` resolves the latest `google-genai` release and its transitive dependencies from the configured index.
3. A package maintainer account, distribution channel, configured mirror, or dependency release is compromised or begins serving malicious content.
4. Because no reviewed version or integrity hash is enforced, `pip` accepts the changed package.
5. Malicious package code executes during installation, import, or subsequent SDK use with the privileges of the invoking user or environment.

### Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the user running `pip` or importing the package. Depending on that environment, the attacker could access application data and credentials available to the process, modify files writable by the user, make network requests, or compromise the associated virtual environment. The project itself does not request elevated privileges, so system-wide impact wo
...[truncated 78 chars]

Remediation

View remediation

Remediation Suggestions

• Pin google-genai to an exact, reviewed version rather than implicitly installing the latest release.
• Record all transitive dependencies in a lockfile generated from a trusted environment.
• Require cryptographic hashes during installation, for example:

  bash

  python -m pip install --require-hashes -r requirements.txt
  

• Install dependencies in a dedicated, least-privileged virtual environment or container.
• Use only trusted package indexes and explicitly configure approved index URLs where appropriate.
• Enable dependency vulnerability and provenance monitoring, then review and deliberately update pinned versions.
• Avoid running package installation as root or another privileged account.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill includes code examples that upload local image, video, and audio files to the Gemini API, but it does not warn users that those files leave the local environment and are transmitted to a third-party service. In a developer guide, this omission can lead users to unintentionally send sensitive media or regulated data off-device, especially because the examples present upload flows as routine and safe-by-default.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The context caching example encourages storing a large document remotely with a one-hour TTL but does not disclose that document contents may persist on the provider side for that period. This is risky because users may cache proprietary source code, internal documents, or personal data without understanding the retention implications and expanded exposure window.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.