SerpAPI

• Analyzed: May 12, 2026, 3:05 AM
• Findings: 1
• Version: 1.0.0
• Hash: 4f6a8426b4eb7caba4fedc4884f04d85258526213cd6fe19c40dfde02f4b3621
• Source: palm
• External report: View on VirusTotal

Findings (1)

This skill is designed to interact with the legitimate SerpAPI service. It securely retrieves the `SERPAPI_API_KEY` from environment variables and optionally reads a default location from `TOOLS.md` within the workspace, which is a standard configuration pattern for agent skills. All network requests are directed to `https://serpapi.com`, and parameters are properly encoded using `urllib.parse.urlencode`, preventing injection vulnerabilities. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts against the agent in `SKILL.md` or `scripts/serp.py`.