grok-search
Pass
Audited by Gen Agent Trust Hub on Apr 11, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: All external network requests are directed to the official xAI API at api.x.ai, which is a well-known service.
- [SAFE]: The skill manages authentication using the XAI_API_KEY environment variable or standard .env configuration files, following secure development practices.
- [SAFE]: The implementation is lightweight and secure, utilizing only built-in Node.js modules without any third-party dependencies or external script downloads.
- [PROMPT_INJECTION]: The skill presents an inherent surface for indirect prompt injection because it retrieves and processes untrusted content from the public web and X posts.
- Ingestion points: External search results are retrieved from the provider in scripts/grok-search.mjs.
- Boundary markers: Absent; the script returns the raw output and citations from the provider without adding delimiters or instructions to ignore embedded commands.
- Capability inventory: The skill is restricted to making HTTP requests to the xAI API and reading local configuration files.
- Sanitization: No sanitization or filtering is performed on the search results before they are delivered to the agent context.
Audit Metadata