Duckduckgo Websearch

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a straightforward DuckDuckGo search helper, with normal web-query sharing and a minor Node/npm dependency declaration issue.

This skill looks safe for normal web search use. Before installing, note that your queries are sent to DuckDuckGo, returned snippets come from untrusted web content, and the skill appears to require Node plus an npm dependency even though the registry metadata does not declare required binaries.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Search terms may be sent to DuckDuckGo when the skill is used.

Why it was flagged

The script sends the user's search query to DuckDuckGo and also has a DuckDuckGo HTML fallback. This is expected for the stated search purpose, but users should know queries leave the local environment.

Skill content
const u = 'https://api.duckduckgo.com/?' + qs.stringify({ q: query, format: 'json', no_html: 1, no_redirect: 1 });
Recommendation

Avoid putting highly sensitive private information in search queries, and treat returned results as web-sourced information.

What this means

Installation or execution may require Node/npm setup that is not fully represented in the registry metadata.

Why it was flagged

The skill depends on an npm package and a Node runtime, while the registry requirements list no required binaries and there is no install spec. The lockfile pins the resolved package, so this is mainly an under-declared setup dependency.

Skill content
"dependencies": {
    "node-html-parser": "^7.0.2"
  }
Recommendation

Declare Node and npm dependency requirements clearly in metadata or install documentation, and install dependencies from the included lockfile.

What this means

Search snippets could contain inaccurate, manipulative, or prompt-like text from the web.

Why it was flagged

The skill intentionally returns externally sourced search-result text. That content is useful for search, but it should not be treated as trusted instructions for the agent.

Skill content
Return structured results: concise summary (if available), top 5 links with titles and snippets
Recommendation

Use search results as reference material only; do not let returned snippets override the user's request or system instructions.