Security audit

Pansxng Websearch

Security checks for vulnerabilities and agentic risk

Overview

This is a real local search skill, but a normal search can install software, change shell startup files, run background services, and overstates its privacy protections.

Review carefully before installing. Treat first use as a host setup operation, not just a search query: it may install Homebrew, Python 3.11, Valkey, and SearXNG, clone code from GitHub, install Python packages, edit ~/.zshrc, and start local services. Do not rely on its privacy claim unless you separately configure trusted VPN, proxy, or Tor routing.

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill advertises shell execution, file reads/writes, and automatic installation behavior, but declares no permissions or user-consent boundaries. In this context, the skill can modify the host system, install packages, clone code, and start services without transparent authorization, which materially increases the risk of unintended system changes or abuse.

Intent-Code Divergence

Medium

Confidence: 85% confidence
Finding: The privacy claim is overstated: routing requests through a local SearXNG instance does not make the user's IP untraceable, because upstream search engines and network observers still see the host's public IP unless an additional anonymity layer is used. Absolute privacy/security claims can mislead users into riskier behavior based on false assumptions.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: A search skill should not silently perform system-wide package manager installation and modify the user's shell profile as part of normal operation. This crosses the boundary from application behavior into host persistence and software deployment, creating significant supply-chain and integrity risk if triggered unexpectedly or abused.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The search flow automatically installs Python and starts additional services unrelated to a simple search request. This expands the attack surface, changes the host state, and can execute privileged or security-sensitive operations without the user clearly intending to authorize environment provisioning.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: At runtime, the skill clones code from GitHub and installs Python dependencies from that repository, then executes the downloaded application locally. This is a direct remote code execution and supply-chain risk because the exact code and dependencies are not pinned, verified, or reviewed before execution.

Description-Behavior Mismatch

Medium

Confidence: 86% confidence
Finding: The code rewrites application configuration and hard-codes a predictable secret key for the SearXNG instance. Predictable secrets weaken trust boundaries and could enable tampering or session-related abuse if the local service is exposed beyond the intended loopback-only context or later reconfigured.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger phrases are extremely broad and overlap with normal conversation, such as generic requests to search or ask what something is. Because this skill performs privileged setup on first use, broad activation raises the chance of accidental invocation that leads to package installation, cloning, or service startup without the user realizing they triggered a system-changing skill.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The skill states that first use will automatically install Homebrew, Python 3.11, Valkey, and SearXNG with no prerequisite or warning. Automatic installation of multiple system dependencies on casual use is dangerous because it causes significant persistent system changes, expands the attack surface, and may execute remote install scripts or unreviewed package operations without informed consent.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The documented setup chain includes automatic cloning, dependency installation, configuration, and service startup. In a search skill, this context makes the behavior more dangerous because a user may expect a simple web query, not background services and persistent software deployment; this mismatch increases the likelihood of unintended privileged actions.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The script downloads and executes a remote installation script for Homebrew using curl piped into bash without prior confirmation. This is a classic high-risk supply-chain pattern that enables arbitrary code execution from the network and is especially dangerous because it happens automatically within a search skill.

Missing User Warnings

High

Confidence: 96% confidence
Finding: Appending to ~/.zshrc modifies the user's shell startup behavior and creates persistence without explicit approval. For a search utility, altering login shell configuration is not necessary for immediate functionality and can have lasting side effects on the host environment.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: On first use, the skill clones SearXNG and installs Python dependencies automatically, meaning a simple search request can trigger large, security-sensitive host changes and execution of unreviewed code. The lack of a clear warning or consent at the point of action makes accidental exposure and trust abuse more likely.

Static analysis

No suspicious patterns detected.