DuckDuckGo(API)

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:08 AM UTC
• Version: 0.2.0

Overview

This is a straightforward DuckDuckGo search skill, but its installation and workflow examples include unsafe shell execution patterns that users should review before installing.

Install only after reviewing the setup commands. Prefer installing uv and ddgs through trusted, pinned, or lockfile-based methods instead of pipe-to-shell installers, and avoid putting secrets, credentials, private project names, or sensitive internal text into search queries or proxy URLs. If using the OpenClaw bash workflow example, ensure the query is safely passed as an argument rather than interpolated into a shell string.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:213
• Finding: Unverified Remote Installer Is Executed Directly by the Shell## Vulnerability Details **File Location**: `SKILL.md`, lines 213-218 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical **Vulnerable Code**: ```bash # macOS/Linux curl -LsSf https://astral.sh/uv/install.sh | sh # Windows powershell -c "irm https://astral.sh/uv/install.ps1 | iex" ``` ### Technical Analysis The installation instructions retrieve a mutable script from an external server and immediately execute the response using `sh` or PowerShell `Invoke-Expression`. The content is not pinned to a reviewed version and is not validated using a cryptographic hash or publisher signature before execution. Even if `astral.sh` is the expected official source for `uv`, the effective code executed by these commands can change after the Skill has been reviewed. Compromise of the upstream site, distribution infrastructure, DNS resolution, or trusted TLS environment could replace the installer with arbitrary commands. This behavior exceeds the minimum privileges needed for the declared web-search functionality. The search script requires Python and the `ddgs` package, but it does not inherently require executing a live remote installer. The installer receives all privileges of the user running the documented command. ### Attack Path 1. A user follows the documented instructions because `uv` is not installed. 2. The shell or PowerShell client requests the current installer from the external URL. 3. An upstream compromise or network trust failure causes a malicious response to be returned. 4. The pipe passes the response directly to `sh`, or `Invoke-Expression` evaluates it in PowerShell. 5. The remote payload executes without an opportunity for version verification, checksum validation, or review. 6. The payload performs arbitrary actions under the invoking user's identity. ### Impact Assessment Successful exploitation provides arbitrary code execution with the privileges of the use ...[truncated 718 chars]
• Remediation: ## Remediation Suggestions - Remove all `curl | sh` and `Invoke-Expression` installation instructions. - Prefer installation through a trusted operating-system package manager with signed packages and a documented, version-pinned release. - If a standalone installer is necessary, require users to: 1. Download a specific immutable release artifact. 2. Obtain its expected SHA-256 digest from a separately authenticated source. 3. Verify the digest or publisher signature. 4. Inspect the downloaded script before execution. 5. Execute it as an ordinary, non-administrative user. - Document a `pip`-based installation path that does not require `uv`. - Pin the supported `uv` version and update it through a controlled review process. - Avoid suppressing diagnostic output during security-sensitive downloads so users can identify unexpected redirects or failures.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:34
• Finding: Third-Party Dependency Is Installed Without Version or Integrity Pinning## Vulnerability Details **File Location**: `SKILL.md`, lines 34-37 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium **Vulnerable Code**: ```bash # Install dependencies using uv uv pip install ddgs # Or use pip pip install ddgs ``` ### Technical Analysis The installation commands resolve and install the current `ddgs` package and its transitive dependencies from the configured package index. They do not specify an exact version, use a reviewed lockfile, or require cryptographic hashes. The dependency list elsewhere in the document states `ddgs >= 8.0.0`, which is also an open-ended constraint. It allows any future compatible release to be installed without another review of this Skill. Consequently, the code eventually executed by `from ddgs import DDGS` is not fully represented by the audited repository. Package installation and import can execute attacker-controlled Python code. A compromised package release, compromised package-index account, unsafe package source, or malicious transitive dependency could therefore turn the documented installation or later script invocation into arbitrary local code execution. ### Attack Path 1. A user follows the documented `uv pip install ddgs` or `pip install ddgs` command. 2. The package manager resolves the latest available version and its transitive dependencies. 3. A compromised or unexpectedly changed package version is selected because no exact version or hash is required. 4. Malicious package code executes during installation or when `scripts/ddgs_search.py` imports `DDGS`. 5. The malicious code accesses resources available to the invoking user. This finding does not establish that the current `ddgs` package is malicious. The risk arises because the instructions permit future, unaudited dependency content to be selected and executed. ### Impact Assessment Exploitation could provide arbitrary code execution with the p ...[truncated 611 chars]
• Remediation: ## Remediation Suggestions - Pin `ddgs` to an exact, reviewed version rather than using an unbounded install command or `>=` constraint. - Commit a dependency lockfile that records all transitive dependency versions. - Use hash-verified installation, such as a requirements file with `--require-hashes`. - Explicitly document the trusted package index and prevent fallback to untrusted indexes. - Install dependencies inside an isolated virtual environment under an unprivileged account. - Review dependency updates before modifying the lockfile, and use automated vulnerability and provenance checks. - Consider publishing a reproducible environment specification so users install the same reviewed dependency set.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# macOS/Linux
curl -LsSf https://astral.sh/uv/install.sh | sh

# Windows
powershell -c "irm https://astral.sh/uv/install.ps1 | iex"

• Confidence: 98% confidence
• Finding: The pipe-to-shell pattern removes any opportunity to review downloaded content before execution and is a classic command-chaining abuse pattern. In the context of a skill meant for agent-assisted use, this is more dangerous because users may copy the command verbatim and execute untrusted remote code without scrutiny.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill documents and enables network access and use of environment-derived proxy settings, but it does not declare any explicit tool scope such as permissions or allowed-tools. In an agent ecosystem, missing scope declarations weakens policy enforcement and increases the chance the skill is invoked with broader capabilities than intended.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation encourages sending search queries and optional proxy credentials to external services, but it does not warn users that their prompts, queries, IP metadata, and embedded proxy credentials may leave the local environment. This can lead to accidental disclosure of sensitive data, especially when an agent passes internal project terms or secrets into search queries.

External Script Fetching

Low

• Category: Supply Chain

Content

```bash
# macOS/Linux
curl -LsSf https://astral.sh/uv/install.sh | sh

# Windows
powershell -c "irm https://astral.sh/uv/install.ps1 | iex"

• Confidence: 96% confidence
• Finding: The skill recommends fetching and executing a remote installer script directly from the network. If the remote host, transport, or content is compromised, users may execute arbitrary code on their machine with their current privileges.

Static analysis

No suspicious patterns detected.