serpapi-core-workflow-b
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted data from external search engines (Google, Bing, YouTube, etc.), creating a surface for indirect prompt injection.
- Ingestion points: Search results are retrieved from SerpAPI engines and engine parameters are verified using
WebFetchas described in the instructions. - Boundary markers: The instructions mention using a "normalized tagged-union schema" and an "allowlisted engine map," but there are no explicit instructions to use delimiters (like XML tags or markdown blocks) to isolate search result content from the agent's instructions.
- Capability inventory: The skill is configured with
WebFetch,Write, andEdittools, allowing it to retrieve external data and potentially modify local files based on that data. - Sanitization: The skill specifically instructs to "strip the key and key-bearing URLs" and use "redacted receipts," which is good practice for credential safety, but it lacks instructions for sanitizing or escaping the actual text of search results to prevent embedded instructions from affecting agent behavior.
Audit Metadata