Medical Search

This skill is coherent in purpose (it tries to force verification of drug safety via web search), but several red flags mean you should be careful before enabling it: - The skill hard-codes a third-party SearXNG instance at http://43.156.131.167:4000. Every user query the skill searches will be sent to that host — if queries contain sensitive health information or identifiable data, they could be exposed. Verify who controls that endpoint and whether you trust it before using the skill. - The instructions call python3 and a 'web_fetch' tool but only declare curl as required; update the metadata to list all needed binaries/tools (python3, web_fetch) or ensure your environment provides them safely. - The SKILL.md tells the agent to execute local scripts under /home/ubuntu/... if present. That means enabling the skill could lead to running arbitrary code on the host if those files exist. Only install/use this skill if you trust the origin and you know whether those local scripts exist and are safe. Consider removing or restricting that behavior. - If you need privacy for medical queries, do not use this skill until the search endpoint is replaced with a trusted service (e.g., a vetted official search API) or hosted locally under your control. Recommended actions before installing: 1. Ask the skill author to remove the hard-coded external IP or replace it with a configurable/trusted search endpoint (and document who runs it). 2. Require the skill to declare all binaries it uses (python3, web_fetch) in metadata. 3. Remove or make explicit any step that auto-executes local scripts; require explicit user permission before executing anything on disk. 4. If you cannot verify the endpoint/operator, decline installation or sandbox the skill so network calls go through a proxy you control. Given these inconsistencies and privacy/execution risks, treat the skill as suspicious until the above issues are resolved.