tinyfish-search
Pass
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Recommends installing the '@tiny-fish/cli' package globally via npm to provide the required functionality. This is a standard installation procedure for the tool.
- [COMMAND_EXECUTION]: Executes shell commands to interact with the 'tinyfish' CLI for searching the web and fetching markdown or JSON representations of web pages.
- [PROMPT_INJECTION]: The skill is potentially susceptible to indirect prompt injection because it fetches and processes content from external, untrusted URLs. * Ingestion points: Content enters the agent's context through the 'tinyfish fetch content get' command. * Boundary markers: There are no explicit instructions to delimit the fetched content or treat it as untrusted data. * Capability inventory: The skill uses the 'bash' tool to execute system commands. * Sanitization: No sanitization or filtering of the retrieved content is performed before it is processed by the agent.
Audit Metadata