skills/algolia/skills/instantsearch/Gen Agent Trust Hub

instantsearch

Pass

Audited by Gen Agent Trust Hub on May 7, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to use curl to query the official Algolia API (e.g., *.algolia.net) for schema discovery. This process uses credentials explicitly provided by the user for this purpose and follows the principle of least privilege by requesting a search-only API key.
  • [COMMAND_EXECUTION]: Includes instructions to use grep on local node_modules to identify CSS class names, which is a benign diagnostic operation.
  • [EXTERNAL_DOWNLOADS]: The skill requires installation of official, well-known libraries from the vendor including react-instantsearch, vue-instantsearch, and algoliasearch using standard package managers (npm, yarn, etc.).
  • [PROMPT_INJECTION]: The skill includes a data ingestion point where it fetches records from the user's index to understand the schema. While this introduces a surface for indirect prompt injection from external data, the risk is negligible as the data is used for structural discovery and involves human-in-the-loop confirmation.
Audit Metadata
Risk Level
SAFE
Analyzed
May 7, 2026, 03:05 PM
Security Audit — agent-trust-hub — instantsearch