Security audit

DuckDuckGo(API)

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward DuckDuckGo search skill, but its installation and workflow examples include unsafe shell execution patterns that users should review before installing.

Install only after reviewing the setup commands. Prefer installing uv and ddgs through trusted, pinned, or lockfile-based methods instead of pipe-to-shell installers, and avoid putting secrets, credentials, private project names, or sensitive internal text into search queries or proxy URLs. If using the OpenClaw bash workflow example, ensure the query is safely passed as an argument rather than interpolated into a shell string.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:213
Finding: Unverified Remote Installer Is Executed Directly by the Shell
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 213-218
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code:

bash
# macOS/Linux curl -LsSf https://astral.sh/uv/install.sh | sh # Windows powershell -c "irm https://astral.sh/uv/install.ps1 | iex"

Technical Analysis

The installation instructions retrieve a mutable script from an external server and immediately execute the response using sh or PowerShell Invoke-Expression. The content is not pinned to a reviewed version and is not validated using a cryptographic hash or publisher signature before execution.

Even if astral.sh is the expected official source for uv, the effective code executed by these commands can change after the Skill has been reviewed. Compromise of the upstream site, distribution infrastructure, DNS resolution, or trusted TLS environment could replace the installer with arbitrary commands.

This behavior exceeds the minimum privileges needed for the declared web-search functionality. The search script requires Python and the ddgs package, but it does not inherently require executing a live remote installer. The installer receives all privileges of the user running the documented command.

Attack Path

A user follows the documented instructions because uv is not installed.

The shell or PowerShell client requests the current installer from the external URL.

An upstream compromise or network trust failure causes a malicious response to be returned.

The pipe passes the response directly to sh, or Invoke-Expression evaluates it in PowerShell.

The remote payload executes without an opportunity for version verification, checksum validation, or review.

The payload performs arbitrary actions under the invoking user's identity.

Impact Assessment

Successful exploitation provides arbitrary code execution with the privileges of the use ...[truncated 718 chars]
Remediation: View remediation
Remediation Suggestions

Remove all curl | sh and Invoke-Expression installation instructions.

Prefer installation through a trusted operating-system package manager with signed packages and a documented, version-pinned release.

If a standalone installer is necessary, require users to:

Download a specific immutable release artifact.

Obtain its expected SHA-256 digest from a separately authenticated source.

Verify the digest or publisher signature.

Inspect the downloaded script before execution.

Execute it as an ordinary, non-administrative user.

Document a pip-based installation path that does not require uv.

Pin the supported uv version and update it through a controlled review process.

Avoid suppressing diagnostic output during security-sensitive downloads so users can identify unexpected redirects or failures.

T08 · Insecure Dependencies

Warning

Location: SKILL.md:34
Finding: Third-Party Dependency Is Installed Without Version or Integrity Pinning
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 34-37
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code:

bash
# Install dependencies using uv uv pip install ddgs # Or use pip pip install ddgs

Technical Analysis

The installation commands resolve and install the current ddgs package and its transitive dependencies from the configured package index. They do not specify an exact version, use a reviewed lockfile, or require cryptographic hashes.

The dependency list elsewhere in the document states ddgs >= 8.0.0, which is also an open-ended constraint. It allows any future compatible release to be installed without another review of this Skill. Consequently, the code eventually executed by from ddgs import DDGS is not fully represented by the audited repository.

Package installation and import can execute attacker-controlled Python code. A compromised package release, compromised package-index account, unsafe package source, or malicious transitive dependency could therefore turn the documented installation or later script invocation into arbitrary local code execution.

Attack Path

A user follows the documented uv pip install ddgs or pip install ddgs command.

The package manager resolves the latest available version and its transitive dependencies.

A compromised or unexpectedly changed package version is selected because no exact version or hash is required.

Malicious package code executes during installation or when scripts/ddgs_search.py imports DDGS.

The malicious code accesses resources available to the invoking user.

This finding does not establish that the current ddgs package is malicious. The risk arises because the instructions permit future, unaudited dependency content to be selected and executed.

Impact Assessment

Exploitation could provide arbitrary code execution with the p ...[truncated 611 chars]
Remediation: View remediation
Remediation Suggestions

Pin ddgs to an exact, reviewed version rather than using an unbounded install command or >= constraint.

Commit a dependency lockfile that records all transitive dependency versions.

Use hash-verified installation, such as a requirements file with --require-hashes.

Explicitly document the trusted package index and prevent fallback to untrusted indexes.

Install dependencies inside an isolated virtual environment under an unprivileged account.

Review dependency updates before modifying the lockfile, and use automated vulnerability and provenance checks.

Consider publishing a reproducible environment specification so users install the same reviewed dependency set.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: The pipe-to-shell pattern removes any opportunity to review downloaded content before execution and is a classic command-chaining abuse pattern. In the context of a skill meant for agent-assisted use, this is more dangerous because users may copy the command verbatim and execute untrusted remote code without scrutiny.
Content: Scanner excerpt · SKILL.md (reported line 215)May include surrounding context.
bash
# macOS/Linux curl -LsSf https://astral.sh/uv/install.sh | sh # Windows powershell -c "irm https://astral.sh/uv/install.ps1 | iex"

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill documents and enables network access and use of environment-derived proxy settings, but it does not declare any explicit tool scope such as permissions or allowed-tools. In an agent ecosystem, missing scope declarations weakens policy enforcement and increases the chance the skill is invoked with broader capabilities than intended.
Content: No source excerpt is available for this finding.

Missing User Warnings