web-research-parallel
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
python3to parse a local JSON configuration file andcurlto send requests to the web research API. These actions are used solely for setting up environment variables and executing research tasks. - [DATA_EXFILTRATION]: The skill retrieves API credentials from
~/.gooseworks/credentials.json. This file is the official location for credentials related to the developer's services, and the data is only used to authenticate requests to the vendor's API. - [EXTERNAL_DOWNLOADS]: The skill refers to the
gooseworkspackage vianpxfor account login. This is a tool provided by the vendor for managing authentication. - [PROMPT_INJECTION]: The skill exposes a surface for indirect prompt injection by ingesting and processing content from external web searches (ingestion points: search and extract endpoints in SKILL.md). No explicit boundary markers or sanitization logic is defined for handling this untrusted content, and the agent has the capability to execute API commands via curl. However, this is consistent with the skill's purpose and no malicious intent was found.
Audit Metadata