search
Pass
Audited by Gen Agent Trust Hub on May 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
scripts/ddgs_search.pyscript specifies a dependency on theddgspackage (version 9.14.2 or higher) within its PEP 723 script metadata. This is a standard library used to programmatically interface with DuckDuckGo. - [COMMAND_EXECUTION]: The
scripts/ddgs_search.pyscript manages search attempts by spawning subprocesses usingasyncio.create_subprocess_exec. This mechanism is used to handle process timeouts and retry logic effectively. The commands executed are self-referential, calling the script's own file viasys.executablewith strictly typed arguments from the command-line parser. - [DATA_EXFILTRATION]: The skill performs network operations to transmit search queries to external services like DuckDuckGo. This is the core functionality of the skill and is required to fulfill search and research requests.
- [PROMPT_INJECTION]: The skill processes untrusted content retrieved from external websites via search results. This presents a surface for indirect prompt injection where web content could contain instructions aimed at the agent. The skill instructions in
SKILL.mdemphasize summarizing and synthesizing sources, which acts as a procedural control for handling this data.
Audit Metadata