google-search-extension
Pass
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
scripts/setup.shscript downloads and executes an initialization script from the vendor's official repository atgithub.com/FinpeakInc/frevana-cli-releases. This is a standard functional requirement for configuring the Frevana environment.\n- [COMMAND_EXECUTION]: The main script executes thefrevanacommand-line tool. It safely constructs the required JSON arguments using Python'sjson.dumps, ensuring that user-provided prompts do not lead to shell command injection.\n- [PROMPT_INJECTION]: The skill processes user-supplied text for Google searches. While it lacks explicit markers to isolate these instructions, the risk is handled by the skill's primary search purpose and secure transport of data to the underlying tool.\n - Ingestion points: User prompts received via
--promptor--prompt-fileinscripts/search_google_extension.sh.\n - Boundary markers: Absent.\n
- Capability inventory: Invokes the
frevanaCLI and writes search results to local files in the specified output directory.\n - Sanitization: User inputs are serialized into JSON within a Python environment before being passed to the tool, preventing executable string interpolation.
Audit Metadata