serpapi
Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill relies on the
@useclawlink/clipackage, which is downloaded and executed vianpx. This is a vendor-owned package used for the tool's core functionality.- [COMMAND_EXECUTION]: The skill requires executing shell commands using thenpxutility to perform authentication, connection, and search operations.- [PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted data from various external search engines (Baidu, Bing, DuckDuckGo, etc.). This content could potentially contain instructions designed to influence the AI agent's behavior. - Ingestion points: Multiple search actions in
SKILL.md(e.g.,serpapi_baidu_search,serpapi_bing_search,serpapi_duck_duck_go_search). - Boundary markers: No delimiters or specific 'ignore instructions' warnings are provided for the search result data.
- Capability inventory: The agent has the ability to execute shell commands via the
@useclawlink/clitool. - Sanitization: No sanitization or filtering of the external search content is mentioned.
Audit Metadata