SearXNG Local Search

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 11:27 PM UTC
• Version: 1.0.2

Overview

This skill is a straightforward SearXNG web-search connector, with setup and transport risks users should manage but no hidden or purpose-mismatched behavior found.

Install this if you intend to use a SearXNG instance for agent web search. For safer use, run SearXNG locally or use HTTPS for any remote endpoint, treat search queries as data sent to that server, replace the sample secret key, and pin or verify the Docker image instead of relying on the mutable latest tag.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:36

Finding

Mutable Container Image Tag Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:34-42
Vulnerability Type: Unpinned third-party container dependency
Risk Level: Medium

Vulnerable Code Snippet:

yaml

services:
  searxng:
    image: searxng/searxng:latest
    container_name: searxng
    ports:
      - "8080:8080"
    volumes:
      - ./searxng:/etc/searxng:rw
    environment:
      - SEARXNG_BASE_URL=http://localhost:8080/

Technical Analysis

The deployment instructions use the mutable image tag searxng/searxng:latest. A mutable tag does not identify the exact container artifact reviewed or originally installed. The registry owner—or an attacker who compromises the image repository—can replace the image referenced by that tag without changing this Skill.

When the user subsequently pulls or deploys the image, Docker may execute code that differs from the version expected during review. The container also receives a writable bind mount at ./searxng:/etc/searxng:rw, allowing code inside the image to modify the host-side SearXNG configuration directory. The actual privileges available beyond that directory depend on the Docker configuration and host environment.

Attack Path

1. The upstream image repository, publishing account, or build pipeline is compromised, or the latest tag is updated with an unsafe image.
2. A user follows the documented instructions and runs docker compose up -d, or later pulls the mutable tag during an update.
3. Docker retrieves the new image referenced by searxng/searxng:latest.
4. Attacker-controlled code executes inside the container.
5. That code can access the container's network and modify data exposed through the writable ./searxng:/etc/searxng bind mount.

Impact Assessment

Successful exploitation permits arbitrary execution inside the deployed container with the container's assigned privileges. It may expose search traffic, alter search responses, access reac ...[truncated 255 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the container image to a reviewed immutable digest, for example:

  yaml

  image: searxng/searxng@sha256:<verified-image-digest>
  

• Record the corresponding release version and establish a controlled process for reviewing and updating the digest.

• Verify image signatures or provenance attestations where supported.

• Configure automated vulnerability scanning for the pinned image.

• Run the container as a non-root user with dropped Linux capabilities and a read-only root filesystem where compatible.

• Change the configuration mount to read-only after initial setup if runtime writes are unnecessary.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:17

Finding

Remote Search Queries May Be Transmitted over Plaintext HTTP

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:17-26, 66
Vulnerability Type: Insecure transport configuration
Risk Level: Medium

Vulnerable Code Snippet:

yaml

command:
  kind: http
  method: GET
  url: ${SEARXNG_URL:-http://localhost:8080}/search
  query:
    q: ${query}
    categories: ${categories}
    format: json

bash

export SEARXNG_URL="http://localhost:8080"

Technical Analysis

The default loopback endpoint is appropriate for a service running on the same machine. However, SEARXNG_URL accepts an arbitrary endpoint without requiring HTTPS or limiting plaintext HTTP to loopback addresses. If a user configures a remote http:// address, search terms and returned results traverse the network without transport encryption or server authentication.

The tool uses HTTP GET, placing the search query in the request URL. In addition to network interception, URL-based queries may be retained in proxy, server, monitoring, or access logs. Search terms can contain private operational details even though this Skill does not request credentials.

Attack Path

1. A user configures SEARXNG_URL with a remote plaintext endpoint such as http://search.example.net.
2. The agent invokes the search tool with a potentially sensitive query.
3. The query is included in the GET request URL and transmitted without TLS.
4. A network-positioned attacker, compromised gateway, or untrusted proxy observes or modifies the request.
5. The attacker can learn the search terms or tamper with the JSON response, potentially causing the agent to consume misleading search results.

Impact Assessment

Exploitation can compromise the confidentiality and integrity of search requests and responses. An attacker may obtain query contents and metadata or manipulate returned titles, links, and snippets. This issue does not directly grant local code execution or elevated system privileges, but mani ...[truncated 194 chars]

Remediation

View remediation

Remediation Suggestions

• Permit plaintext HTTP only when the resolved destination is a loopback address such as 127.0.0.1, ::1, or an explicitly trusted local Unix-socket proxy.
• Require an https:// URL for every non-loopback SearXNG endpoint.
• Preserve normal TLS certificate and hostname verification; do not document insecure certificate-bypass options.
• Validate SEARXNG_URL against an explicit scheme and host policy before making requests.
• Document that search terms are sent as URL parameters and may appear in server or proxy logs.
• Where supported by the server and tool framework, consider POST requests for searches that may contain sensitive text, while retaining HTTPS because POST alone does not provide transport confidentiality.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The configuration example sets default_lang: "en", which imposes a specific language/locale in natural-language configuration. The file does not offer user opt-in or explain that the skill is intentionally region- or language-specific, so this conflicts with the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.