Security audit

Searx Search

Security checks across malware telemetry and agentic risk

Overview

This web-search skill appears useful, but it may send user queries to rotating public SearX services without enough disclosure or scoping.

Install only if you are comfortable with search terms being sent to independently operated public SearX instances. Avoid using it for secrets, internal company information, personal data, credentials, private URLs, or sensitive investigations unless the skill is updated to use a trusted allowlist or your own self-hosted SearX instance with explicit user confirmation.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill describes network and shell-based behavior but does not declare permissions, which weakens platform governance and informed consent around outbound requests. In this context, the skill sends user queries to external services, so missing permission declarations materially increase the risk of unnoticed data egress and unsafe execution expectations.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: A description-behavior mismatch is dangerous because reviewers and users may approve the skill under false assumptions about where queries go and how many third-party endpoints are contacted. If the code falls back to hard-coded instances and retries far more broadly than documented, sensitive user queries may be sent to unvetted services, increasing exposure, tracking, and unexpected data sharing.

Vague Triggers

Medium

Confidence: 77% confidence
Finding: Overly broad trigger language can cause the skill to activate in situations the user did not clearly intend, leading to unnecessary transmission of prompts or queries to third-party search instances. Because this skill performs outbound web searches, ambiguous activation increases privacy risk and can cause accidental disclosure of sensitive or internal information.

Vague Triggers

Medium

Confidence: 79% confidence
Finding: Ambiguous examples in the overview broaden the operational scope without clear boundaries, which can lead the agent to route general topical requests to a third-party web service. In this context, that increases the chance of unintended externalization of user content, especially for current-events or news requests that might include sensitive framing or context.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The documentation omits a warning that user queries are sent to public third-party SearX instances, which is a significant transparency and privacy issue. In this skill's context, search terms may contain personal data, confidential business information, or sensitive topics, and sending them to rotating public instances materially raises the risk of logging, profiling, or interception.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script sends user search queries to arbitrary public SearX instances obtained from a third-party service, without disclosure or any trust boundary controls. In a skill context, users may submit sensitive prompts, and those queries can be logged, profiled, or inspected by unknown instance operators, making this a real privacy and data-exposure risk.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.