Trust Assessment
serpapi received a trust score of 87/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 2 medium, and 0 low severity. Key findings include Sensitive environment variable access: $HOME, Unencoded user input in URL parameters.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Sensitive environment variable access: $HOME Access to sensitive environment variable '$HOME' detected in shell context. Verify this environment variable access is necessary and the value is not exfiltrated. | Static | skills/ericsantos/serpapi-search/scripts/search.sh:46 | |
| MEDIUM | Unencoded user input in URL parameters The `search.sh` script constructs a URL for `curl` using user-provided arguments for `--country`, `--lang`, and `--num`. These arguments are directly interpolated into the URL parameters without URL encoding. An attacker could inject additional URL parameters or manipulate existing ones by providing values like `us&malicious_param=value` for `--country`, potentially altering the API request in unintended ways. Ensure all user-controlled inputs used in URL parameters are properly URL-encoded. The `urlencode` function already exists in the script and should be applied to `COUNTRY`, `LANG`, and `NUM` variables before they are included in the `PARAMS` string. | LLM | scripts/search.sh:60 |
Scan History
Embed Code
[](https://skillshield.io/report/870209f37f8ae177)
Powered by SkillShield