duckduckgo-search
Pass
Audited by Gen Agent Trust Hub on May 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the 'duckduckgo-search' package from the official PyPI registry via pip or uv. This is a standard and well-known library for its claimed purpose.\n- [COMMAND_EXECUTION]: The skill utilizes 'python -c' to execute scripts that interact with the search library and save results to local JSON files. These commands are necessary for the skill's functionality and are documented clearly.\n- [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface because it ingests data from the public internet into the agent's context.\n
- Ingestion points: Search result titles, snippets, and bodies are retrieved from DuckDuckGo and printed in SKILL.md.\n
- Boundary markers: No explicit markers are used to delimit external content from system instructions.\n
- Capability inventory: The skill utilizes shell execution (Bash) and file system writes as described in SKILL.md.\n
- Sanitization: Web content is processed directly without filtering for potential instructions.
Audit Metadata