ClawHub
Back to skill

Security audit

DDGS Metasearch via local MCP

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent web-search integration, but it asks users to install an unpinned third-party package and optionally enable a persistent local service without enough containment or removal guidance.

Install only if you are comfortable running DDGS as a local service and sending search queries through its configured backends. Prefer an on-demand or virtual-environment install, avoid enabling the systemd service unless you need always-on search, and add your own disable/removal and package pinning controls before using it in automation.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T06 · System Persistence

Error
Location
SKILL.md:32
Finding

Persistent User-Level DDGS Service

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
SKILL.md:9
Finding

Unpinned Upgrade and Installation of a Third-Party Python Package

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill advertises itself for broad 'general web search' use, which can cause over-activation for many user requests and route tasks to an external/local search service without clear user intent or least-privilege scoping. In agent environments, broad activation increases the chance of unnecessary network access, privacy leakage in queries, and accidental invocation in contexts where safer built-in tools should be preferred.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
87% confidence
Finding

The instructions to create a user-level systemd service establish durable session persistence for the search server. Even though the service binds to 127.0.0.1, a long-lived local service still broadens the local attack surface and can be abused by other local processes or invoked unintentionally in later sessions.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

text

### Optional: systemd user service (always available)
Create `~/.config/systemd/user/ddgs.service`:
```ini
[Unit]
Description=DDGS MCP SSE server

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

The skill instructs enabling a persistent user systemd service, causing the DDGS server to auto-start and remain available across sessions. Persistence expands the attack surface by keeping a local HTTP/SSE service running continuously, increasing exposure to misuse, stale configurations, or unintended data access beyond the immediate task.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

Then:

bash
systemctl --user daemon-reload
systemctl --user enable --now ddgs
systemctl --user status ddgs --no-pager

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill sets a default region of 'us-en' without user opt-in, which can bias results and silently transmit locale preferences that may not match the user's location or intent. While not a direct code-execution risk, it can create privacy and integrity issues by returning skewed search results and mishandling geographically sensitive requests.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.