Skills/Glama/gemini-pro-mcp

gemini-pro-mcp@0.1.2

VERIFIED· not started

Publisher claims: "Use your Google AI Pro subscription from Claude Code, Codex, Antigravity and Gemini CLI. Gemini 4 Argon via the Antigravity CLI with no API bill, Deep Research, Google Flow (Veo/Omni) videos of any length, Gemini Notebooks (NotebookLM Audio Overviews), AI Mode, Jules, plus Nano Banana images and Omni Flash video through the Gemini API. One-command setup and a doctor check." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher muzaqil555 · publishing for 6 daysInstalls 0Last detonated 6d ago
$npx skills add gemini-pro-mcp
WatchReport an issue

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
GEMINI_API_KEYGOOGLE_API_KEYJULES_API_KEYConfiguration, not credentials: AGY_PATH, CODEX_HOME, GEMINI_PRO_AGY_MODEL, GEMINI_PRO_AGY_TIMEOUT, GEMINI_PRO_CHROME, GEMINI_PRO_ENV_FILE, GEMINI_PRO_FLOW_PORT, GEMINI_PRO_FLOW_PROFILE, GEMINI_PRO_FLOW_PROJECT, GEMINI_PRO_OUTPUT_DIR
Where it talks to
no vendor host named in the codeAlso google.com, antigravity.google, flowmusic.app, playground.google — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names google.com, antigravity.google, flowmusic.app, playground.google as well as its own vendor. The guard injects GEMINI_API_KEY, GOOGLE_API_KEY, JULES_API_KEY only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- <the server's command>

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-08 and scored it 83/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.2sprocessdependency install exit 1 ·
0.2sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.2sprocessscript backend runs setup only
0.2sprocessno install scripts to re-run

Static findings

MEDIUM
Python subprocess execution detectedsrc/gemini_pro_mcp/flow/browser.py:99 · Python subprocess execution detectedsubprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/gemini_pro_mcp/install.py:53 · Python subprocess execution detectedout = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathssrc/gemini_pro_mcp/config.py:16 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesDEFAULT_ENV_FILE = Path.home() / ".config" / "gemini-pro-mcp" / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_server.py:125 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv = tmp_path / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/gemini_pro_mcp/install.py:254 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesblock += ["", f"[mcp_servers.{value(name)}.env]"]Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
Prompt injectiondocs/README.az.md:52 · Prompt injection — known jailbreak technique reference · informational: not an instruction file…, `image_generate`) üçün [Google AI Studio](https://aistudio.google.com/apikey)-dan API açarı lazımdır. Onu `~/.config/gemini-pro-mcp/.env` faylına `GEMINI_API_KEY…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Python subprocess execution detectedtests/test_stitch.py:11 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
LOW
Prompt injectiondocs/README.tr.md:52 · Prompt injection — known jailbreak technique reference · informational: not an instruction file…, `image_generate`) için [Google AI Studio](https://aistudio.google.com/apikey)'dan bir API anahtarı gerekir. Onu `~/.config/gemini-pro-mcp/.env` dosyasına `GEMINI…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
HIGH
Access to sensitive file pathssrc/gemini_pro_mcp/config.py:1 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Settings, read from environment variables and an optional .env file.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedsrc/gemini_pro_mcp/install.py:274 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathssrc/gemini_pro_mcp/config.py:5 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files~/.config/gemini-pro-mcp/.env (or point GEMINI_PRO_ENV_FILE at another file).Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

Cost to the agent

Instructions loaded
≈38 tok
1 file · 48 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.