web-search-pro
Pass
Audited by Gen Agent Trust Hub on Mar 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the
lightpandabinary viaasyncio.create_subprocess_execto fetch and convert web pages to Markdown. The command uses static arguments except for the URL and search query, which are appropriately handled. - [EXTERNAL_DOWNLOADS]: The skill performs network requests to SearXNG instances (user-configurable via
SEARXNG_URL) andbing.comto retrieve search data. These are standard operations for a web search tool. - [COMMAND_EXECUTION]: The orchestrator script accepts JSON tasks via command-line arguments (
sys.argv[1]). While it parses this input to determine search queries, the execution path for external binaries is controlled and does not allow for arbitrary shell injection.
Audit Metadata