Google SERP Ai Overview API

• Outcome: Pass
• Latest audit: Jun 9, 2026 at 1:49 PM UTC
• Version:
  1.0.1

Overview

The skill appears to make a disclosed, purpose-aligned external API request, with only a privacy-disclosure improvement needed.

Before installing, treat any URL you submit as data shared with Just Serp API. Avoid submitting private, internal, or sensitive URLs unless you are comfortable with that third-party processing.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This manifest describes a GET request to an external API and sends the required `url` query parameter to `https://api.justserpapi.com`. The file does not include any warning, disclosure, or user-facing note that the provided URL will be transmitted to a third-party service, which is a missing-warning issue for markdown/code-adjacent operation definitions under this rule.

VirusTotal

64/64 vendors flagged this skill as clean.