multi-search-engine
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads search results from DuckDuckGo, Brave, and Tavily, which are established and well-known search services.\n- [COMMAND_EXECUTION]: Executes the local Python script 'scripts/search.py' to aggregate search data from various engines.\n- [DATA_EXFILTRATION]: Transmits the user's search query to external providers (DuckDuckGo, Brave, and Tavily) to fulfill the search request.\n- [PROMPT_INJECTION]: An indirect prompt injection surface exists through the ingestion of external web content.\n
- Ingestion points: Search snippets and titles are retrieved from the web via 'scripts/search.py'.\n
- Boundary markers: Absent; results are returned in JSON without specific delimiters for external text.\n
- Capability inventory: No risky capabilities such as file modification or arbitrary command execution are used to process the untrusted content.\n
- Sanitization: Web search results are handled as raw strings without additional filtering or sanitization.
Audit Metadata