gemini-search — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited gemini-search (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill when the user invokes /gemini-search … or whenever you need current web information.
Goal: run a grounded web search with Gemini using Google's Enterprise Web Search, then present Gemini's answer with inline citations, Search Suggestions, and a source list — without adding your own analysis or interspersing other content.
Always turn what the user said into a search query string first.
/gemini-search …Treat the text after /gemini-search as user intent, not necessarily a perfectly-formed query.
site: / filetype: / quotes), keep it as-is.Generate a query from the user's most recent request.
"…".site:….filetype:pdf.(term1 OR term2).Do not show your query-building reasoning. Optionally, you may show the final query as a single line: Query: …
Use the Bash tool to execute the request.
Important implementation notes
Replace <QUERY> with the final query string from Step 0 (escape " as \" and \ as \\ within the JSON):
curl -sS --max-time 90 -X POST "https://api.ai.it.cornell.edu/chat/completions" \
-H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"model": "google-enterprise-web-search",
"tools": [{"enterpriseWebSearch": {}}],
"messages": [
{
"role": "user",
"content": "<QUERY>"
}
]
}'$ANTHROPIC_AUTH_TOKEN must be set in the environment.--max-time 90.This endpoint returns standard OpenAI Chat Completions JSON.
Primary answer is in choices[0].message.content. This is the Grounded Result.
Search Suggestions are the search queries Google provides alongside Grounded Results. You must always display them whenever they are present.
Look for:
["What is a monstera?"]). Display these in CLI output.vertex_ai_grounding_metadata[0].searchEntryPoint.renderedContent also exists but is HTML/CSS meant for web UIs — not usable in a CLI context.Inline citations are required. Displaying grounding support helps validate responses and provides avenues for further learning. Use groundingSupports and groundingChunks to attach citation markers to specific claims in the Grounded Result text.
Source data comes from two places (they encode the same information in different formats):
#### Vertex grounding metadata (preferred — richer structure)
vertex_ai_grounding_metadata[0] contains:
web.uri — An opaque Google redirect URL (the Link per the Service Specific Terms). This is the actual clickable URL for the source.web.title — Title or label for the source (often a domain name like "ivywise.com").web.domain — Domain of the source.segment.startIndex / segment.endIndex / segment.text — Identifies the span of text in the Grounded Result that is supported.groundingChunkIndices[] — Array of indices into groundingChunks[] identifying which sources support this segment.#### OpenAI-style annotations (alternative)
choices[0].message.annotations[] where type == "url_citation". Each entry includes title, url, and start_index/end_index. These carry the same citation information as the Vertex metadata but in a flatter format.
#### Building inline citations
Use the groundingSupports array to insert citation markers into the Grounded Result text. The approach (matching the pattern shown in the Gemini API documentation):
groundingChunks.groundingSupports by endIndex in descending order (to avoid shifting issues when inserting markers).[1], [2]) at the endIndex position in the text, referencing the corresponding groundingChunkIndices.In CLI output, format the inline markers as bracketed references like [1] or [1][3], then list the full sources (title, domain, and full URI) at the bottom.
If the curl command fails, returns non-JSON, or choices[0].message.content is missing/empty:
$ANTHROPIC_AUTH_TOKEN is set.choices[0].message.content) as-is. Preserve its formatting.[1], [2]) at the end of each supported text segment, as described in Step 2.3. This is the only permitted modification to the Grounded Result text.Insert citation markers directly into the Grounded Result text at the positions indicated by groundingSupports. Example output:
Cornell University is widely recognized as a distinguished Ivy League
institution with a unique public-private character, serving as New York's
federal land-grant university.[1][2] This distinct status contributes to
its broad academic scope and commitment to public engagement across
various fields of knowledge.[2]If webSearchQueries is present, display them immediately after the Grounded Result under a ## Search Suggestions heading, exactly as returned:
## Search Suggestions
- query one
- query twoOmit this section if no Search Suggestions are present.
After the Search Suggestions (or after the Grounded Result if no suggestions), add a ## Sources heading.
For each entry in groundingChunks, display all three fields: title, domain, and the full uri. The numbers must correspond to the inline citation markers used in the text. Format each source as:
[index] title (domain)
uriExample:
## Sources
[1] wikipedia.org (wikipedia.org)
https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQG01p6km6QF2eDrt9ZPqyYgD0n3cMKnuCB4YygpoqdGZncsbwvdMwuptEecOwbpWfeejovsMZqHgUGmoT_ZOZ1mvajDpAmsbbjoFOpw9YsQsGP6topznyoF2qvGHcpl66rD417b8D97z16e-5Gpxes=
[2] anthropic.com (anthropic.com)
https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGreAd7WMBS-olPa2utmulVfxXjwuxdDL1FYUl13FI2t4pxUxp6vbXJN_Cl8WGUwIhM0jxIOTE3ttIanLBx7_YATUKbYlEjHBuCAHL5KHaHCaLPLkW9Xbkeb0AK4jloHIAT
[3] claude.com (claude.com)
https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHHPspB_TC3Akc8e4yGkwL3dveCgltUUwVN3qh9u3eZJGAQM8ZdFsdoCjDQn_MHVLzKybeSzykPv9BwqpsEIZaHMoSlzVOxJOyy7dTHICFwJQxGBCltXT4VA6dytsqqfJpYUVtFWqFcBWAQvKl4_GZEAXJRTTrdU1MUVg==Always show the full, untruncated URI. Do not shorten or omit any part of it.
De-duplicate entries that share the same title, domain, and uri. Entries from the same domain but with different redirect URIs are distinct sources (they point to different pages) and should be listed separately.
Omit this section if no citations are present.
This skill uses Web Grounding for Enterprise (enterpriseWebSearch), governed by the Service Specific Terms:
choices[0].message.content. It is generated using the prompt, any contextual information, and results from GCP's web index.webSearchQueries[] that Google provides alongside Grounded Results. Must be displayed whenever present.groundingChunks[].web.uri and annotations[].url_citation.url, as well as the titles/labels provided with them.webSearchQueries strings exactly as returned, alongside the Grounded Result.groundingSupports and groundingChunks to connect specific claims back to their sources.groundingChunks entry: title, domain, and the full untruncated uri.Original skill author: Jai Chandnani (@jaichandnani), Cornell AI Hub.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.