private-web-search-searchxng

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:14 PM UTC
• Version: 1.3.2

Overview

The skill’s private search purpose is coherent, but it asks users to run an unpinned persistent Docker service exposed on port 8080 and includes a weak helper script input path.

Review before installing. Prefer a pinned SearXNG image digest, bind the service to 127.0.0.1, avoid running the npx installer or Docker commands with elevated privileges, and treat the helper script limit argument as numeric-only until fixed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/search.sh:13

Finding

Unvalidated Result Limit Allows jq Program Injection

Content

View full analysis

Remediation

View remediation

100 )); then echo "Error: limit must be an integer between 1 and 100" >&2 exit 1 fi ``` Pass the value to jq as data instead of constructing jq source code: ```bash curl -fsSL "http://${HOST}:${PORT}/search?q=${QUERY}&format=${FORMAT}" | jq --argjson limit "$LIMIT" \ '.results[:$limit] | .[] | {title, url, engine}' ``` For additional hardening: - Validate `SEARXNG_FORMAT` against an explicit allowlist. - Use curl's URL encoding facilities for the query rather than directly embedding it in the URL. - Use `-f` so HTTP errors cause curl to fail. - Enable strict shell behavior where appropriate, such as `set -euo pipefail`. ]]>

T08 · Insecure Dependencies

Warning

• Location: README.md:13

Finding

Unpinned npx Installation Tool Creates a Supply-Chain Execution Risk

Content

View full analysis

Remediation

View remediation

add adelpro/private-web-search-searchxng ``` Also pin the installed Skill to a specific release, tag, or preferably an immutable commit where supported. Document the expected package source and integrity information. Additional controls should include: - Use a lockfile or equivalent integrity mechanism where possible. - Recommend reviewing package metadata and provenance before execution. - Avoid running the installer with `sudo` or an administrator account. - Consider providing a manual installation procedure from a signed release archive with a published SHA-256 checksum. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:27

Finding

Mutable SearXNG Container Image Is Executed Without Version or Digest Pinning

Content

View full analysis

Remediation

View remediation

@sha256: ``` Further hardening should include: - Bind the published port to `127.0.0.1` if only local access is required. - Verify the image digest and publisher provenance before use. - Use a non-root container user where supported. - Drop unnecessary Linux capabilities and enable `no-new-privileges`. - Apply CPU, memory, and process limits. - Reassess whether persistent `--restart unless-stopped` behavior is necessary; omit it when cross-restart persistence is not required. - Establish a controlled process for reviewing and updating the pinned digest. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md

docker restart searxng

# Verify
curl -s "http://localhost:8080/search?q=test&format=json&engines=bing&num_results=1" | python3 -c "import sys,json; d=json.load(sys.stdin); print(f\"Results: {d.get('number_of_results',0)}\")"

## Usage

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The install instruction uses npx skills add adelpro/private-web-search-searchxng without pinning an exact package or tool version, so users may execute whatever version of the skills package is current at install time. That creates a supply-chain risk: a compromised upstream package, a malicious update, or behavior drift could lead to unexpected code execution during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The Docker command pulls and runs searxng/searxng without a fixed tag or digest, meaning future installs may retrieve a different image than the author tested. If the image is updated unexpectedly or the registry account is compromised, users could run unreviewed code with container privileges and exposed network services.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill invokes shell commands extensively, including Docker lifecycle operations and curl-based network access, but does not declare any explicit tool scope or allowed-tools restrictions. That increases the chance an agent can execute broader shell actions than intended, making misuse or prompt-injection-induced command execution more dangerous in this operational context.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The Docker run command uses the floating image reference searxng/searxng without a pinned tag or digest, so future pulls may retrieve a different or compromised image than the author tested. In a skill that instructs agents to launch containers, this creates a supply-chain risk with potentially arbitrary code execution inside the pulled container and exposure of the host via Docker-mounted capabilities or published ports.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.