serpapi-hello-world
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: No malicious patterns, obfuscation, or unauthorized access attempts were detected. The skill uses standard libraries to interact with a legitimate third-party API. The implementation follows security best practices for credential management by instructing users to use environment variables (
SERPAPI_API_KEY) instead of hardcoding sensitive tokens. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external search engine results (Google, Bing, YouTube) which are outside of the agent's control. While this represents a surface for potential injection, the provided scripts only display the data and do not use it to drive further automated actions or command execution.
- Ingestion points: Results returned from
client.search(Python) andgetJson(Node.js) inSKILL.md. - Boundary markers: None; results are treated as plain text for display.
- Capability inventory: The skill is limited to printing search results; no file-writing or subprocess execution using external data is implemented.
- Sanitization: None; data is printed directly to console.
Audit Metadata