Versioned security assessment

Report ID: SA-D71C7417

7/12/2026, 10:27:09 AM

web-search security assessment v5

Skill Security Certification Report

Audit History
Audit model: codex Latest published report
Skill name
web-search
Version
v5
Maintainer
101-skills
Source
github.com/101-skills/skills/tree/main/tools/llm/web-search/
Coverage
1 Files scanned · 153 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Medium

2 confirmed security findings require attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

The skill intentionally runs belt and npx commands, including third-party installation and remote search requests. Most static alerts are Markdown formatting, while several command blocks and one remote image are genuine security surfaces. The workflows also disclose inputs externally and may pass untrusted web content into language models.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 153 Lines analyzed

14 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 9 evidence locations

Filesystem access

May read or write local files.

Not recorded by this audit

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 25 evidence locations

Capability review items (12)
Medium
SKILL.md:7
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
Line 7 instructs users to execute npx and install a third-party skill, creating package and supply-chain exposure.
Medium
SKILL.md:19-24
Ruby/shell backtick execution
```bash
Lines 19 through 24 run belt login and a remote Tavily app, which are intentional external command executions.
Medium
SKILL.md:48-52
Ruby/shell backtick execution
```bash
Lines 48 through 52 execute belt app run to send a query to the Tavily search service.
Medium
SKILL.md:58-62
Ruby/shell backtick execution
```bash
Lines 58 through 62 execute belt app run and submit URLs to Tavily for extraction.
Medium
SKILL.md:68-72
Ruby/shell backtick execution
```bash
Lines 68 through 72 execute belt app run and send a search query to Exa.
Medium
SKILL.md:78-82
Ruby/shell backtick execution
```bash
Lines 78 through 82 execute belt app run and send a factual question to Exa.
Medium
SKILL.md:88-92
Ruby/shell backtick execution
```bash
Lines 88 through 92 execute belt app run and submit a URL to Exa for extraction.
Medium
SKILL.md:98-108
Ruby/shell backtick execution
```bash
Lines 98 through 108 run Tavily and OpenRouter commands and redirect search output into a local file.
Medium
SKILL.md:112-122
Ruby/shell backtick execution
```bash
Lines 112 through 122 run Tavily and OpenRouter commands and redirect extracted content into a local file.
Medium
SKILL.md:134-143
Ruby/shell backtick execution
```bash
Lines 134 through 143 execute three npx installation commands for external skills without pinned versions.
Medium
SKILL.md:143-145
Ruby/shell backtick execution
```
The finding range includes the instruction to run belt app store, which invokes an external CLI.
Low
SKILL.md:13
Hardcoded URL
![Web Search & Extraction](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwtt8krr/01kgndq
Line 13 embeds a remotely hosted image, allowing the host to observe requests from documentation viewers.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (2)

RISK-001 Medium
SKILL.md:48-91
User Data Sent to External Search Providers
The examples send user queries, questions, and target URLs through belt to Tavily, Exa, and inference.sh services.
The documented commands explicitly place queries, questions, and URLs in inputs for remote provider applications.
RISK-002 Medium
SKILL.md:96-121
Untrusted Web Content Used in LLM Workflows
The workflows recommend summarizing retrieved web material without guidance for resisting instructions embedded in that material.
The examples combine search or extraction with LLM prompts, although placeholders prevent fully automatic data flow.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Medium
    The installation examples execute third-party packages without a pinned version.
    Pin package and skill versions, publish integrity information, and require user confirmation before installation.
  2. FIX-002
    Medium
    Search queries, questions, URLs, and extracted content are sent to external providers.
    Document each provider and warn users not to submit secrets, personal data, or private URLs.
  3. FIX-003
    Medium
    Retrieved web content may contain instructions designed to manipulate a language model.
    Tell agents to treat retrieved text as untrusted data and never follow instructions embedded in source content.
  4. FIX-004
    Low
    The documentation embeds an image from an external host.
    Bundle the image with the skill or use a trusted marketplace proxy to prevent viewer tracking.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
d71c7417a35d5c2624161bd2fe8de8a41a362128
Content hash
22a0ec550a3d0e13caf251d6a0d08c81cb387b7ec4af98c194299393101cf5b9
Tree hash
2bf7bddaf9e10d180db80bbcb2c96514b18e90bbbee41a90b8f361ff81375c36
Skill path
skills/101-skills/web-search
Audit payload hash
a33dc236c22cf6e1e93baf0593232100

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable