web-search-andi
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes shell commands to manage authentication and interact with the search API. Evidence: Uses python3 to parse the API key from ~/.gooseworks/credentials.json. Evidence: Employs curl to send POST requests for searching and retrieving endpoint details.
- [EXTERNAL_DOWNLOADS]: The skill makes network calls to retrieve search results and metadata from the vendor's infrastructure. Evidence: Directs requests to api.gooseworks.ai, which is the official domain for the skill vendor.
- [PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it retrieves and processes content from the open web. Ingestion points: Results from the search query endpoint in SKILL.md. Boundary markers: Not specified. Capability inventory: Shell access through curl and python3. Sanitization: No explicit validation or filtering of search results is described.
Audit Metadata