serpapi-automation
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- EXTERNAL_DOWNLOADS (LOW): The skill instructs users to add a remote MCP server at
https://rube.app/mcp. Since this domain is not on the 'Trusted External Sources' list, it is classified as an unknown external dependency. - INDIRECT_PROMPT_INJECTION (LOW): The skill relies on dynamically discovered tool schemas and outputs from
RUBE_SEARCH_TOOLS. There is a potential surface for indirect injection if tool results are not sanitized, though no active exploitation is present. - DATA_EXFILTRATION (SAFE): No evidence of unauthorized data access or exfiltration. The skill uses a managed connection workflow (
RUBE_MANAGE_CONNECTIONS) for authentication rather than hardcoded secrets. - NO_CODE (SAFE): This skill is entirely instructional and does not ship with any local executable scripts or binary files.
Audit Metadata