web-search
Fail
Audited by Snyk on Feb 16, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 1.00). The prompt includes an example that embeds an API key directly in a curl request (https://serpapi.com/...&api_key=API_KEY), which instructs including secrets verbatim in generated commands and therefore risks exfiltration.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill explicitly performs web searches and fetches arbitrary public web pages (e.g., DuckDuckGo HTML search, curl examples, and WebFetch(url="...")) and instructs the agent to read/interpret those page contents, exposing it to untrusted third-party user-generated content.
Audit Metadata