ClawHub
Back to skill

Security audit

Gemini Guide

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only Gemini API guide with expected examples for API keys and file uploads, but users should handle secrets and sensitive files carefully.

Reasonable to install as a Gemini API reference. Before copying examples, keep API keys in environment variables or a secret manager, avoid committing keys, and only upload or cache files you intentionally want processed by Google Gemini, especially for confidential, personal, or regulated data.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill includes code that instantiates a Gemini client with an API key and uploads local files such as images, video, and audio to a third-party API, but it does not warn users that selected local content will be transmitted off-host. In an agent-skill context, this omission can lead users to unintentionally expose sensitive local data or secrets, especially if examples are copied verbatim or adapted into automated workflows.

Static analysis

No suspicious patterns detected.