free-web-search-ai
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill implements a coherent web-search aggregator (Tavily + SearXNG + Crawl4AI) and the code, instructions, and requirements align with that purpose; nothing in the package indicates hidden exfiltration or unrelated privileges.
This skill appears to do what it says, but review these points before installing: (1) You must provide a Tavily API key and SearXNG URL (the key is stored in config.py by default — protect that file). (2) Dependencies (tavily-python, crawl4ai, etc.) are pulled from PyPI; verify those packages and your environment before pip installing. (3) The crawler will fetch arbitrary web pages and cache results/logs to /tmp — avoid running on sensitive networks or with credentials exposed to crawled sites. (4) If you want stronger secret handling, put API keys in a protected location or use environment variables instead of a plaintext config. (5) Running concurrent crawls may trigger remote rate limits — reduce CONCURRENT_CRAWL/MAX_CRAWL if needed.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
No VirusTotal findings
Risk analysis
No visible risk-analysis findings were reported for this release.