serper-scholar
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests and processes untrusted data from external academic sources via the Serper API.
- Ingestion points: The serper_scholar tool fetches external content including paper titles, abstracts (snippets), and author information.
- Boundary markers: The skill instructions do not define clear boundaries or provide explicit warnings to the agent to disregard instructions potentially hidden in the fetched academic content.
- Capability inventory: The skill has the capability to execute searches and format the resulting external data for user presentation.
- Sanitization: No sanitization, filtering, or escaping mechanisms are described to handle potentially malicious strings returned by the search API.
Audit Metadata