unifuncs-deep-search

Pass

Audited by Gen Agent Trust Hub on Mar 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The deep-search-report.py script uses subprocess.Popen to spawn a background worker process of itself. This is used to maintain a long-running connection to the vendor's streaming API while allowing the parent process to return partial results to the user. The command is constructed as a list of arguments and executed without a shell (shell=False is the default), which effectively prevents command injection attacks.
  • [EXTERNAL_DOWNLOADS]: All scripts communicate with the official API endpoints at api.unifuncs.com. These network operations are intended for the skill's primary purpose of performing deep searches and retrieving results from the vendor's service.
  • [SAFE]: Credential management follows best practices by instructing users to store their API key in an environment variable (UNIFUNCS_API_KEY) rather than hardcoding it. File system operations are restricted to the creation and cleanup of temporary stream files in the system's temporary directory for result caching.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 30, 2026, 01:25 AM