Agent skill · security · jeremylongshore
serpapi-security-basics
Threat-model SerpAPI credentials, query data, result retention, browser exposure, logs, and ZeroTrace tradeoffs. Use when reviewing or hardening a search integration. Trigger with "secure a SerpAPI integration".
Why this skill is useful
Provides specific security practices and code examples for securely handling SerpApi API keys that the AI wouldn't reliably generate on its own.
What it needs
Requires serpapi account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
SerpAPI Security and Privacy Controls Overview Protect the private key and treat queries, parameters, raw results, archive records, fixtures, and telemetry as potentially sensitive data. Prerequisites Application and data-flow inventory, data classification, threat model, and retention policy Account plan and entitlement evidence for any privacy feature Owners for secrets, application security, privacy, logging, and incident response Tool Discipline Use Read, Glob, and Grep to inspect secret flow, browser bundles, logs, caches, and fixtures, WebFetch to verify current security and retention claims, and Write or Edit for server-side boundaries, redaction, tests, and evidence. Current Contract SerpAPI requires a private API key and recommends server-side use for web applications. Standard search data is documented as expiring after 31 days. Enterprise ZeroTrace mode uses zerotrace=true to skip storing search parameters, files, and metadata, which also removes archive-based debugging; eligibility and exact guarantees must be rechecked against the account contract. Authentication Keep SERPAPIKEY in an approved server-side secret manager. Never ship it in browser or mobile bundles, accept it from end users, include it in URLs that are logged, or return Account API data to unauthenticated clients. Instructions 1. Map the key from secret store to client and prove it cannot reach source, client bundles, logs, traces, caches, fixtures, errors, or support exports. 2. Classify queries and results, document permitted purposes, and reject disallowed or unnecessarily sensitive input before search. 3. Expose an application-specific backend endpoint with authenticated callers, input allowlists, output minimization, rate limiting, and abuse monitoring. 4. Strip key-bearing URLs and unneeded raw result fields before persistence; set cache and log retention from policy rather than convenience. 5. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/serpapi-security-basics