dsh-search-plugin
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill performs standard network operations to a public, read-only API at
api.dshfind.com. All core logic inscripts/search_plugin.pyrelies on the Python standard library (urllib). - [DATA_EXPOSURE]: The
scripts/profile_store.pyscript manages a local user profile for cross-session preferences. It includes a proactive security filter (SENSITIVE_PARTS) that prevents the persistence of fields containing keywords like 'token', 'secret', or 'api_key'. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from the external dshfind gateway. While this data is presented to the user/agent, it is processed via
json.loadsand is not used as input for dangerous execution sinks such aseval()or shell commands, minimizing the risk of automated instruction obedience. - [COMMAND_EXECUTION]: The skill provides deterministic CLI tools for searching and profile management. These tools perform specific, documented tasks and do not allow for arbitrary command injection or privilege escalation.
Audit Metadata