gemini-search-mcp-web-search
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements tools (
web_searchandask) that fetch and synthesize content from the live web, introducing a surface for indirect prompt injection attacks. - Ingestion points: The
web_search(query)andask(prompt)tools ingest untrusted data from external websites. - Boundary markers: The documentation does not specify the use of delimiters or 'ignore instructions' directives for the fetched content.
- Capability inventory: The skill possesses network access, browser control via subprocesses, and the ability to process and synthesize web data for the agent.
- Sanitization: There is no mention of sanitizing or filtering instructions that might be embedded in the fetched search results.
- [DATA_EXFILTRATION]: The skill encourages the use of persistent browser profiles via the
GEMINI_SEARCH_USER_DATA_DIRenvironment variable to bypass CAPTCHAs. - Evidence: The configuration instructions suggest pointing the server to persistent directories like
~/.local/share/gemini-search-mcp/chrome-profile. Such profiles typically contain sensitive information including cookies, session tokens, and browsing history which could be exposed if the server or search session is compromised. - [COMMAND_EXECUTION]: The server manages and launches browser processes using local command execution.
- Evidence: The
GEMINI_SEARCH_BROWSER_BACKENDdefaults tosubprocess, and the documentation provides instructions for launching various browser channels (Chrome, Edge, Chromium) directly from the host system.
Audit Metadata