websearchapi
Fail
Audited by Gen Agent Trust Hub on Feb 26, 2026
Risk Level: HIGHCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The configuration file
tools/websearchapi/config.jsoncontains a hardcoded API key (rEux5Wb3fyHM47TKyCpNdHGf). Storing secrets in plain text within configuration files or source code is a significant security risk as it can lead to unauthorized access and abuse of the associated service account. - [EXTERNAL_DOWNLOADS]: The utility makes outbound network requests to
https://www.searchapi.io/api/v1/search. This is a well-known service used for programmatic search access. The communication is performed using Node.js's built-inhttpsmodule. - [COMMAND_EXECUTION]: The skill is designed to be executed as a CLI tool (
websearchapi.js). While it correctly usesquerystring.stringifyto escape search parameters sent to the API, users should be aware that the tool itself is intended to be called via system command execution (e.g.,execorspawn) which requires careful handling of shell arguments.
Recommendations
- AI detected serious security threats
Audit Metadata