Why this verdict
- suspicious: finding skill:skills/websearch:skills/websearch/pyproject.toml:6:SUPPLY
Security findings 1
Supply chain
highContextual risklow confidenceThe skill's packaging manifest lists the dependency `prime-agent-runtime` with no version constraint, an undeclared moving remote supply-chain reference that the declared Serper web-search purpose does not pin.
prime-agent-runtime
conceal:remotevector:metadata
Counter-argument considered
The manifest factually lists `prime-agent-runtime` with no version constraint and nothing shown pins or declares it; the carve-out covers only pinned official-registry installs, so the unpinned moving reference survives at contextual risk.
Execution chain 12
What it calls, runs, installs, reads and writes, with the line that does it.
Environment variables 5
PRIME_AGENT_CODING_AGENT_DIR
URLs 3
https://google.serper.dev/search
Refuted findings 2
Candidates the review stage examined and rejected, kept for transparency.
Credential access
criticalRefutedlow confidenceThe skill implementation reads the Prime Agent auth.json credential store on every search call to obtain the Serper API key, extending credential access beyond the documented environment-variable channel to the agent's stored key file whose other contents are not constrained by the shown evidence.
Read auth.json on each call (not just the injected env var) so a key added
Why it was refuted
The claim is contradicted by the shown code: access is scoped to the stored Serper credential only and the key is used solely as the X-API-KEY header to the hardcoded google.serper.dev endpoint, and the auth.json read implements the configuration channel the artifact itself documents (paste key via /mcp, then 'the key is saved, web search works automatically'), i.e. the declared-core-capability credential flow rather than an unconstrained extension beyond an env-var channel.
Credential access
criticalRefutedlow confidenceThe skill resolves the 'serper' credential value from the agent's auth.json as an environment-variable name when it is not a literal or command reference, so any environment variable named there is read and transmitted to google.serper.dev in the X-API-KEY header on each search.
return (os.environ.get(value) or value).strip()
Why it was refuted
The env-name indirection is the wrapped-service API-key resolution applied to the agent's own stored 'serper' credential, openly documented in the code as the stored-key convention, and the resolved value flows only into the X-API-KEY header of the hardcoded google.serper.dev endpoint — the env-API-key-for-wrapped-service carve-out, with no attacker-controlled sink or broader env harvesting.
Coverage gaps 9
Parts of the artifact the static analysis could not fully examine.
context:unanalyzable_binary binary content is only byte-scanned
crates/pa-core/src/auth/manager.rs
context:unanalyzable_binary binary content is only byte-scanned
scripts/release/native-compat/photon_rs_bg.wasm
skill_frontmatter_invalid missing name/description frontmatter
skills/factory/SKILL.md
context:frontmatter_unparseable mapping values are not allowed here
skills/factory/SKILL.md
ledger_finding_without_valid_finding run 1: instruction-surface.0 SRC:639d979c76939a3f
ledger_finding_without_valid_finding run 1: instruction-surface.0 SRC:0df16fcb99c65e76
ledger_finding_without_valid_finding run 1: behavior-chains.0 SRC:639d979c76939a3f
invalid_judge_finding instruction-surface.0
invalid_judge_finding behavior-chains.0
