Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Google Shopping search connector for Just Serp API, with expected network and API-key use and no evidence of hidden persistence, local data access, or destructive behavior.
Install this only if you are comfortable sending shopping search terms, localization settings, and your Just Serp API key to Just Serp API. Avoid using sensitive personal, confidential business, or secret data as search queries.
The skill invokes a network-capable helper (node {baseDir}/bin/run.mjs) and is designed to call an external API, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization ambiguity where a host may permit broader capabilities than intended, weakening least-privilege controls and making network use harder to govern or audit.
This code constructs and sends an HTTP request containing user-provided query parameters and an X-API-Key header to an external service. While the script performs the request as intended, there is no confirmation prompt, user-facing log, or comment/docstring warning that input data and credentials will be sent to a third-party API.
The operation documentation describes user-controlled query and localization parameters but does not warn that these values are transmitted to an external third-party API. This can mislead users or downstream agents into sending potentially sensitive search terms, geographic hints, or market-research data off-platform without clear disclosure, creating a privacy and data-handling risk.
No suspicious patterns detected.
