gemini-search-mcp-web-search
Pass
Audited by Gen Agent Trust Hub on Jun 30, 2026
Risk Level: SAFEPROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it retrieves and processes untrusted data from the open web via Google Search results.
- Ingestion points: The
web_searchandasktools ingest real-time web content and synthesized answers from Google AI Mode (SKILL.md). - Boundary markers: The documentation does not specify the use of delimiters or instructions for the agent to ignore potentially malicious commands embedded in the retrieved web content.
- Capability inventory: This skill is intended for use with MCP clients like Claude Desktop, Cursor, and Windsurf, which typically provide the agent with broad file system and terminal access (SKILL.md).
- Sanitization: There is no mention of sanitization or filtering of the search results before they are presented to the agent's context.
- [CREDENTIALS_UNSAFE]: The skill facilitates the use of persistent browser profiles through the
GEMINI_SEARCH_USER_DATA_DIRenvironment variable to reuse cookies and avoid CAPTCHAs. - Evidence: The configuration allows users to point the server to a persistent Chrome profile:
GEMINI_SEARCH_USER_DATA_DIR: "/home/user/.cache/gemini-search-profile"(SKILL.md). This gives the AI agent and the underlying tools access to any session data, cookies, or history stored in that profile.
Audit Metadata