openclaw-serper
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill fetches and extracts full text content from arbitrary web pages discovered through search results. This creates a surface for indirect prompt injection if the agent interprets instructions embedded in the extracted text. 1. Ingestion points: The
scripts/search.pyscript fetches content from external URLs via thetrafilaturalibrary. 2. Boundary markers: The content is provided to the agent within a JSON object without specific delimiters or warnings to ignore instructions found within the content. 3. Capability inventory: The skill uses theBashtool to run its search script and process the results. 4. Sanitization: Thetrafilaturalibrary extracts main text but does not filter for potential prompt injection patterns or adversarial instructions. - [EXTERNAL_DOWNLOADS]: The skill instructs users to install the
trafilaturapackage from the Python Package Index (PyPI), which is a well-known service for Python dependencies. - [COMMAND_EXECUTION]: The skill relies on executing a Python script (
scripts/search.py) which initiates network connections to the Serper API and third-party websites to retrieve information.
Audit Metadata