skills/zhuxining/skills/search/Gen Agent Trust Hub

search

Pass

Audited by Gen Agent Trust Hub on May 13, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The scripts/ddgs_search.py script specifies a dependency on the ddgs package (version 9.14.2 or higher) within its PEP 723 script metadata. This is a standard library used to programmatically interface with DuckDuckGo.
  • [COMMAND_EXECUTION]: The scripts/ddgs_search.py script manages search attempts by spawning subprocesses using asyncio.create_subprocess_exec. This mechanism is used to handle process timeouts and retry logic effectively. The commands executed are self-referential, calling the script's own file via sys.executable with strictly typed arguments from the command-line parser.
  • [DATA_EXFILTRATION]: The skill performs network operations to transmit search queries to external services like DuckDuckGo. This is the core functionality of the skill and is required to fulfill search and research requests.
  • [PROMPT_INJECTION]: The skill processes untrusted content retrieved from external websites via search results. This presents a surface for indirect prompt injection where web content could contain instructions aimed at the agent. The skill instructions in SKILL.md emphasize summarizing and synthesizing sources, which acts as a procedural control for handling this data.
Audit Metadata
Risk Level
SAFE
Analyzed
May 13, 2026, 01:12 PM