Security audit
Security checks for vulnerabilities and agentic risk
This is a narrow Google search results API connector that sends user-provided search parameters to Just Serp API, with no hidden persistence or unrelated system access found.
Install only if you intend to send search queries and any chosen localization parameters to Just Serp API using your JUST_SERP_API_KEY. Avoid entering secrets, private personal data, or unnecessarily precise location context in searches unless you are comfortable sharing that with the API provider.
The skill instructs the agent to perform a networked API call via a Node helper, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates a policy/visibility gap where an agent runtime may permit broader network use than reviewers or users expect, weakening least-privilege controls and making misuse or unintended outbound requests harder to govern.
This code performs an outbound HTTP request to a third-party API using user-provided search terms and optional location/localization parameters, which may expose user or system-derived data externally. While the script validates arguments, it does not include any confirmation prompt, print/log disclosure before transmission, or inline comment/docstring warning users that their inputs are sent to an external service.
This skill is explicitly designed to send user-supplied search queries and optional localization fields such as location, country, UULE, and domain to an external third-party API endpoint. While that behavior is expected for a search connector, the schema provides no explicit warning, consent mechanism, or minimization guidance, which can lead to unintended disclosure of sensitive user input or precise location context to the vendor.
No suspicious patterns detected.
