DDGS Metasearch via local MCP

• Outcome: Pass
• Latest audit: May 29, 2026, 8:22 PM
• Version:
  1.0.1

Overview

This skill is a disclosed local web-search helper; the optional always-on service adds some operational risk but is clear and purpose-aligned.

Install this only if you are comfortable running a local search service and installing mcporter plus the ddgs Python package. Keep it bound to localhost, avoid sensitive searches, and enable the systemd service only if you intentionally want the server to keep running across sessions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Session Persistence

Medium

• Category: Rogue Agent

Content

Then:
```bash
systemctl --user daemon-reload
systemctl --user enable --now ddgs
systemctl --user status ddgs --no-pager
```

• Confidence: 84% confidence
• Finding: systemctl --user enable

Session Persistence

Medium

• Category: Rogue Agent

Content

```

### Optional: systemd user service (always available)
Create `~/.config/systemd/user/ddgs.service`:
```ini
[Unit]
Description=DDGS MCP SSE server

• Confidence: 80% confidence
• Finding: Create `~/.config

VirusTotal

65/65 vendors flagged this skill as clean.