kagi-session2api-mcp-server
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
kagi-session2api-mcppackage from PyPI viapiporuvx. This package is authored by an unverified third party (ara.so), posing a potential supply chain risk if the package is compromised. - [INDIRECT_PROMPT_INJECTION]: The skill's primary functions involve fetching external data that could contain malicious instructions designed to manipulate the AI agent.
- Ingestion points:
kagi_search_fetch(web search results) andkagi_summarizer(URL content summarization) as described inSKILL.md. - Boundary markers: The provided documentation does not include explicit delimiters or warnings to the agent to ignore instructions embedded in the fetched web content.
- Capability inventory: The tools return structured search data and prose/bulleted summaries to the agent's context.
- Sanitization: There is no mention of sanitization, filtering, or validation of the external content before it is processed by the agent.
- [CREDENTIALS_UNSAFE]: The skill requests the use of Kagi session tokens (
KAGI_SESSION_TOKEN) extracted from browser sessions. Unlike official API keys, session tokens represent full account access and are generally more sensitive and fragile. While the skill warns against committing these to version control, their use in this manner increases the risk of account compromise if the environment or configuration files are exposed.
Audit Metadata