ddg-search

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a straightforward DuckDuckGo search CLI skill, with the main cautions being its external npm package install and an unlimited scraping option.

This skill looks benign for searching DuckDuckGo from the command line. Confirm that you trust the npm package before installing, and avoid the unlimited scraping option unless you specifically need it.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the skill will trust the npm package that provides the search CLI.

Why it was flagged

The skill depends on installing an external npm package that provides the executable, while the reviewed artifact set contains only SKILL.md and no package source code.

Skill content

node | package: ddg-search | creates binaries: ddg-search

Recommendation

Before installing, verify the npm package and linked project are the ones you intend to trust.

Low

#ASI02: Tool Misuse and Exploitation

What this means

Using the unlimited mode may generate more search traffic than expected and could trigger DuckDuckGo bot detection.

Why it was flagged

The documented CLI includes an unbounded scraping mode. This is purpose-aligned for a search scraper, but it can make many external requests if used.

Skill content

ddg-search -p 0 "query"                     # unlimited pages (scrape all)

Recommendation

Use bounded page or result limits by default, and only use '-p 0' when you explicitly want an unlimited scrape.