Advanced Searxng Search Skill

PassAudited by ClawScan on May 1, 2026.

Overview

The skill appears to be a coherent SearXNG search client, with ordinary privacy and provenance considerations before use.

This appears safe for its intended purpose if you trust the SearXNG instance you configure. Before installing, verify the source/package because the repository and package metadata are inconsistent, and avoid sending sensitive queries to remote instances.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If you configure a remote SearXNG server, that server may see your search terms and request metadata.

Why it was flagged

Search parameters, including the user's query, are sent to the configured SearXNG instance. This is expected for the skill, but remote instances can observe submitted queries.

Skill content
return self.session.get(url, params=params, timeout=timeout, verify=self.config.verify_ssl)
Recommendation

Use a trusted or local SearXNG instance for sensitive searches, keep SSL verification enabled for HTTPS endpoints, and avoid sending private data in search queries.

What this means

Search results could contain misleading or prompt-like text that an agent should not treat as authoritative instructions.

Why it was flagged

The skill returns external search result snippets as structured content. This is core functionality, but those snippets are untrusted web-derived text.

Skill content
content=result.get("content", "")
Recommendation

Treat returned search result titles, snippets, and metadata as untrusted information and verify important claims before acting on them.

What this means

Installing from the wrong package or source could result in unexpected code being installed.

Why it was flagged

The README indicates the pip package may not be ready, while other packaging files and SKILL metadata still reference pip/local installation. This is a provenance and packaging consistency issue rather than evidence of malicious behavior.

Skill content
pip install searxng-skill # Not yet ready
Recommendation

Verify the package source, repository URL, and version before installing; prefer the reviewed local source if you choose to use it.