Easy Search

PassAudited by ClawScan on May 1, 2026.

Overview

Easy Search appears to be a coherent web-search helper; the main things to notice are that searches go to external providers and may be cached locally.

This skill is reasonable for general web searches. Before installing, be aware that queries can be routed to multiple external search engines, optional Python packages are not version-pinned, and cached results may be stored under your home directory.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

Search terms may be transmitted to Google, Bing, DuckDuckGo, Startpage, or other configured engines depending on availability and settings.

Why it was flagged

The skill may send a search query to different external search engines and can fail over automatically. This is core to the stated web-search purpose and is disclosed, but users should understand where their queries may go.

Skill content

It uses direct HTTP requests and the duckduckgo_search library... Auto engine selection... Smart failover

Recommendation

Avoid putting private secrets or sensitive personal information in search queries, and specify an engine explicitly if you do not want automatic provider selection.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing optional packages without version pins relies on the current package-index contents and the user's trust in those packages.

Why it was flagged

The README shows a placeholder upstream repository and optional unpinned package installs. These are user-directed rather than automatic, but they are still provenance and dependency details a user should verify.

Skill content

git clone https://github.com/your-username/easy-search.git

# Optional: Install dependencies for better results
pip install duckduckgo-search requests

Recommendation

Install optional dependencies only from trusted package indexes, consider pinning versions, and verify the skill source before relying on it.

Low

#ASI06: Memory and Context Poisoning

What this means

Search queries or results may remain on the local machine for repeated searches, and cached web snippets should still be treated as untrusted web content.

Why it was flagged

The script defines a persistent local cache for search behavior. This is consistent with the advertised result caching, but it means search-derived content can be retained and reused briefly.

Skill content

CACHE_DIR = Path.home() / ".easysearch_cache"
CACHE_TTL = 3600  # 1 hour

Recommendation

Use the documented cache-clearing option when needed and avoid searching for confidential data if local query/result persistence is a concern.