OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Fail5 providerslatest audit Apr 20, 2026
Independent checks from skills.sh's audit partners.
The skill provides Google search functionality via the Bright Data SERP API. It contains a command injection vulnerability in the search script where an unsanitized input is used in a shell arithmetic expansion. Additionally, the skill's ingestion of external search results creates a surface for indirect prompt injection.
Detected behaviors
No alerts
1 issue
2/2 files flagged
Score: 93/100 · 2 sections analyzed