ddg-search

DuckDuckGo HTML search scraper CLI with JSON, CSV, OpenSearch, markdown, and compact outputs.

Security Scan

The skill is internally consistent: it wraps a ddg-search CLI, requests the ddg-search binary (installable from npm), and its runtime instructions stay within that purpose.

Purpose & Capability

Name/description (DuckDuckGo HTML search scraper) match the declared requirement (ddg-search binary) and the install spec (npm package 'ddg-search'). The declared binaries and install are proportional to the stated functionality.

Instruction Scope

SKILL.md only instructs running the ddg-search command with flags and shows example pipes (e.g., to jq). It does not ask the agent to read unrelated files, environment variables, or send results to unexpected external endpoints. The behavior described (network scraping of DuckDuckGo, progress to stderr, delays between requests) is consistent with the tool's purpose.

Install Mechanism

Installation is via the npm package 'ddg-search', which is a standard registry-based install (moderate-risk compared to no-install). No arbitrary URL downloads or archive extraction are used. As with any npm package, verify the package owner, recent versions, and known vulnerabilities before installing.

Credentials

The skill requests no environment variables, credentials, or config paths. This is proportionate to a search-scraper CLI.

Persistence & Privilege

The skill is not forced-always, does not request persistent elevated privileges, and does not modify other skills or system-wide agent config. Autonomous invocation is allowed (platform default) but not combined with other red flags.

Assessment

This skill appears to be what it says: an instruction-only wrapper around the ddg-search CLI. Before installing: 1) Verify the npm package 'ddg-search' and its maintainer (check npmjs.org and the GitHub repo) to avoid typosquatting; 2) Inspect the package source (or review its GitHub repo) for unexpected network or file behavior; 3) Install in an isolated or ephemeral environment if you need to limit blast radius; 4) Be aware the CLI performs network requests (it will contact DuckDuckGo) and could expose queries in logs—no credentials are requested by the skill. If you need higher assurance, ask for the package tarball checksum or a link to the published npm package and its source tree to review before installation.

Search DuckDuckGo from the command line. Results go to stdout; progress goes to stderr.

Quick reference

ddg-search "query"                          # default: JSON, 5 pages
ddg-search -f compact "query"               # minimal-token output (best for LLM context)
ddg-search -f jsonl "query"                 # one JSON object per line
ddg-search -n 10 "query"                    # stop after 10 results
ddg-search -p 2 -f json "query"             # 2 pages, JSON
ddg-search -r us-en -t w "recent topic"     # US-English, past week
ddg-search -p 0 "query"                     # unlimited pages (scrape all)

Options

Flag	Long	Description	Default
-f	--format	Output format: json, jsonl, csv, opensearch, markdown, compact	json
-p	--pages	Max pages to scrape (0 = unlimited)	5
-n	--max-results	Stop after this many results	all
-r	--region	Region code (e.g. us-en, uk-en)	all regions
-t	--time	Time filter: d (day), w (week), m (month), y (year)	none

Choosing a format

• compact: Use for feeding results into an LLM. Minimal tokens, no JSON overhead.
• jsonl: Use when piping to line-oriented tools or streaming processors.
• json: Use when you need structured data with OpenSearch metadata, zero-click answers, and spelling corrections. Pipe through jq for field extraction (e.g. | jq '.items[].link').
• csv: Use for spreadsheets or tabular analysis.
• markdown: Use for human-readable output or embedding in documents.
• opensearch: Use when producing Atom XML feeds.

Extracting URLs from JSON output

ddg-search "query" | jq -r '.items[].link'

Notes

• DuckDuckGo may trigger bot detection. The tool stops early and returns whatever results were collected.
• Random delays (800–2900 ms) are inserted between page fetches automatically.
• Progress messages appear on stderr, so redirecting stdout captures only results.