N2 Free Search

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:27 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent web-search MCP setup, but it asks users to run an unpinned npm package locally and under-discloses what happens to public search queries.

Review this before installing. Prefer the self-hosted SearXNG mode for sensitive work, avoid sending secrets or private data in public search queries, and pin or otherwise verify the npm package version before running it in an MCP client.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:26

Finding

Automatic Execution of an Unpinned Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:26-27 and SKILL.md:37-38
Vulnerability Type: Unpinned third-party dependency installation and execution
Risk Level: Medium

Vulnerable Code

Public mode:

json

"command": "npx",
"args": ["-y", "n2-free-search"]

Self-hosted mode:

json

"command": "npx",
"args": ["-y", "n2-free-search"],
"env": {
  "SEARXNG_URL": "http://localhost:8080"
}

Technical Analysis

Both documented configurations invoke npx with the automatic-confirmation option (-y) and an npm package name that has no exact version constraint. Consequently, npm can resolve, download, and execute a mutable package release at runtime without interactive approval.

The artifact does not include the package implementation, a lockfile, an integrity hash, or other controls that bind execution to a reviewed artifact. Its declared repository metadata does not itself ensure that the npm registry package is identical to the reviewed repository source. This creates a supply-chain trust boundary outside the audited project.

This finding does not establish that the current n2-free-search package is malicious. The risk is that a compromised npm package, maintainer account, publication pipeline, or future release could change executable behavior after this Skill has been reviewed.

Attack Path

1. An attacker compromises the npm package, a maintainer account, or its release pipeline and publishes a malicious version under the existing package name.
2. A user applies either MCP configuration from SKILL.md.
3. The MCP client launches npx -y n2-free-search.
4. Because no exact version or integrity value is specified, npm resolves and downloads the attacker-controlled release.
5. npx executes the package locally without requesting confirmation.
6. Malicious package code runs with the operating-system identity, filesystem access, network access, environment variables, and other capabilities available to the MCP server ...[truncated 682 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the floating package reference with an exact, reviewed version, for example:

   json

   "args": ["n2-free-search@1.0.0"]
   

2. Avoid automatic runtime installation where possible. Install the reviewed dependency during a controlled deployment phase and execute the installed binary afterward.
3. Commit and enforce a lockfile containing npm integrity metadata, and use reproducible installation commands such as npm ci.
4. Verify the package tarball's provenance and integrity against a trusted digest or signed release before deployment.
5. Review the actual npm package contents, lifecycle scripts, transitive dependencies, and correspondence with the declared source repository before approving a release.
6. Establish an explicit dependency-update process so that new versions require security review rather than being selected automatically at launch.
7. Run the MCP server under a dedicated, least-privileged account or sandbox with restricted filesystem, environment-variable, credential, and network access.
8. Disable unnecessary npm lifecycle scripts during installation where compatible with the package, and use trusted registry configuration to reduce dependency substitution risk.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly promotes a zero-setup public search mode but does not warn users that search queries will be sent to an external SearXNG service. Agents may forward sensitive prompts, internal project names, credentials, or personal data in search queries, creating an avoidable data exposure risk. Because this skill is designed for web search, the behavior is expected, but the missing disclosure makes it more dangerous in agent contexts where users may assume local or private handling.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.