searxng-tool-for-openclaw

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 12:06 AM UTC
• Version: 1.0.0

Overview

This skill coherently installs and registers a SearXNG web-search tool, with supply-chain and privacy considerations users should review before installation.

Install only if you trust the npm package publisher and the SearXNG server you configure. Prefer pinning an exact package version or verifying package provenance, and avoid sending sensitive queries to a SearXNG instance you do not control or trust.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Unpinned Third-Party Package Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20–24, 65, 72, and 78
Vulnerability Type: Unpinned npm dependency and installer execution
Risk Level: Medium

The skill directs users and OpenClaw to install or execute searxng-tool-for-openclaw without specifying an exact reviewed version or integrity hash.

yaml

    - kind: node
      package: searxng-tool-for-openclaw
      bins:
        - searxng-tool-for-openclaw

markdown

- an executable installer so `npx searxng-tool-for-openclaw install` works

bash

openclaw plugins install searxng-tool-for-openclaw

bash

npx searxng-tool-for-openclaw install

Technical Analysis

These package references have no exact version, lockfile, or integrity constraint. Consequently, the package manager may resolve a newer npm release than the version represented by the locally audited index.ts.

The npx command is particularly sensitive because it downloads the currently resolved package and runs its installer binary. The documentation also states that the package includes an executable installer. If the npm package, publisher account, or a future release is compromised, attacker-controlled installer logic could run even though the code in this project remains unchanged.

This is a software supply-chain weakness rather than evidence that the currently audited index.ts is malicious. The reviewed runtime code otherwise performs the documented SearXNG request and tool registration.

Attack Path

1. An attacker compromises the npm publisher account, gains control of the package, or causes a malicious future version to be published.
2. The attacker adds malicious behavior to the package installer, executable binary, lifecycle script, or plugin entry point.
3. A user follows npx searxng-tool-for-openclaw install or openclaw plugins install searxng-tool-for-openclaw.
4. Because no exact version or integrity value i ...[truncated 1094 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the package to a reviewed exact version in metadata and installation examples, such as searxng-tool-for-openclaw@X.Y.Z; do not use version ranges or floating tags.
2. Replace the floating npx command with an exact-version invocation and disable automatic confirmation where appropriate:

   bash

   npx --yes searxng-tool-for-openclaw@X.Y.Z install
   

3. Record and verify the expected npm tarball integrity hash before installation. Maintain a lockfile where the installation workflow supports one.
4. Verify that the pinned npm artifact corresponds to the source revision that received security review.
5. Publish provenance or signed release attestations and require verification in the release process.
6. Review package lifecycle scripts and installer behavior before approving each version. Prefer installation mechanisms that do not execute lifecycle scripts when they are unnecessary.
7. Run installation with a non-privileged account and restrict access to unrelated secrets, credentials, and sensitive environment variables.
8. Establish an explicit upgrade process so dependency updates undergo review rather than being selected automatically at installation time.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill clearly facilitates network access by installing and configuring a SearXNG-backed search plugin, but it does not declare any explicit tool scope or permissions boundary. This can weaken user and platform visibility into what capabilities the skill requires, making unintended or overly broad network use harder to review and constrain.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

Using npx searxng-tool-for-openclaw install without a pinned version causes execution of whatever package version is current at install time. If the npm package is compromised, replaced, or updated maliciously, users may execute attacker-controlled code during installation with no integrity guarantee.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

Referencing the installer binary as npx searxng-tool-for-openclaw install again encourages unpinned remote code execution from npm. Because npx fetches and runs package code, this creates a supply-chain risk that is especially relevant for installation workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This code performs an HTTP GET to the configured SearXNG instance using the user-provided query and optional parameters, which transmits user data over the network. In this file there is no confirmation prompt, user-facing log/print, or comment/docstring warning that search terms will be sent to an external service.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.