ClawHub
Back to skill

Security audit

SearXNG Metasearch

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward SearXNG setup and usage guide, with disclosed configuration choices users should secure before exposing the service beyond their own machine.

Before installing, change the placeholder secret key, consider pinning the Docker image version, and bind to localhost or firewall port 8080 unless you deliberately want other machines to reach the service. Also review safe_search: 0 if unfiltered results are not appropriate for your environment.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The sample `settings.yml` binds SearXNG to `0.0.0.0`, which exposes the service on all network interfaces. In the context of a self-hosted search service with JSON API enabled and no accompanying warning about access controls, this can unintentionally make the instance reachable by other hosts on the LAN or beyond if port forwarding/firewall rules allow it.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.