Security audit
Security checks for vulnerabilities and agentic risk
This skill mostly performs DuckDuckGo lookups, but it includes an undocumented option that can open search-result pages in the user's local browser.
Review before installing. The normal lookup behavior is coherent, but the package should either remove the --open browser-launching path or clearly document it and require explicit user confirmation before opening any external URL.
The declared behavior says the skill performs lightweight DuckDuckGo instant-answer lookups, but the detected implementation reportedly also scrapes HTML and can launch a local browser or open URLs via subprocess. That mismatch is dangerous because it hides materially different behavior, including host-side side effects and execution paths that can open untrusted content outside the agent's expected sandbox.
The skill advertises executable behavior that uses shell and network capabilities but does not declare any tool scope or permission boundaries. That increases the chance the agent can invoke code with broader access than reviewers or orchestrators expect, which weakens least-privilege controls and makes misuse harder to detect.
The description says to use the skill whenever the user asks to 'look something up online,' 'fetch quick facts,' or do 'lightweight web search,' which are broad, everyday requests that could match many unrelated situations. It does not provide tighter trigger boundaries or exclusion examples, increasing the risk of unintended invocation.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"skip_disambig": 0,
}
)
url = f"https://api.duckduckgo.com/?{params}"
with urllib.request.urlopen(url, timeout=20) as r:
return json.loads(r.read().decode("utf-8", errors="replace"))
The skill description says it returns concise search results, but the code can also open a local browser and navigate to remote URLs via the --open flag. In an agent/tooling context, this expands the capability from passive retrieval to local side effects, which can expose users to unwanted navigation, tracking, or phishing destinations derived from untrusted search results.
Spawning local browser processes is unrelated to simple concise-result retrieval and creates an unnecessary side-effectful execution path. Because the opened URL comes from external search results or API response fields, the tool can drive a user's environment to attacker-controlled pages without a strong trust boundary or confirmation step.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
]
for cmd in cmds:
try:
subprocess.Popen(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
return cmd[0]
except Exception:
continue