Security audit
Security checks across malware telemetry and agentic risk
This search skill is not clearly malicious, but it deserves review because installation can run unverified shell commands, modify local service configuration, and enable autostart behavior.
Install only if you intentionally want an agent-managed local SearXNG deployment. Review the Python script and onboarding commands first, avoid running the pipe-to-shell installer blindly, do not use untrusted SEARXNG_HOST or SEARXNG_PORT values, avoid submitting secrets as searches, and enable autostart only if you accept a persistent local service.
def run(cmd, check=True, cwd=None):
result = subprocess.run(cmd, shell=True, capture_output=True, text=True, cwd=cwd)
if check and result.returncode != 0:
log(f"Error: {result.stderr}")
sys.exit(1)f'{SEARXNG_DIR}/.venv/bin/python -m searx.webapp '
f'--host {SEARXNG_HOST} --port {SEARXNG_PORT}'
)
subprocess.Popen(cmd, shell=True, env=env, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
import time
for _ in range(15):def run(cmd, check=True, cwd=None):
result = subprocess.run(cmd, shell=True, capture_output=True, text=True, cwd=cwd)
if check and result.returncode != 0:
log(f"Error: {result.stderr}")
sys.exit(1)f'{SEARXNG_DIR}/.venv/bin/python -m searx.webapp '
f'--host {SEARXNG_HOST} --port {SEARXNG_PORT}'
)
subprocess.Popen(cmd, shell=True, env=env, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
import time
for _ in range(15):f"http://{SEARXNG_HOST}:{SEARXNG_PORT}",
headers=FORWARDED_FOR
)
resp = urllib.request.urlopen(req, timeout=3)
return resp.status == 200
except:
import timetry:
req = urllib.request.Request(url, headers=FORWARDED_FOR)
with urllib.request.urlopen(req, timeout=10) as resp:
data = json.load(resp)
results = data.get("results", [])def run(cmd, check=True, cwd=None):
result = subprocess.run(cmd, shell=True, capture_output=True, text=True, cwd=cwd)
if check and result.returncode != 0:
log(f"Error: {result.stderr}")
sys.exit(1)chmod +x <skill_dir>/scripts/searxng_cli.py # 创建 symlink（如果不存在） which searxng-search || sudo ln -sf <skill_dir>/scripts/searxng_cli.py /usr/local/bin/searxng-search # 设置 secret（安装时会自动生成，也可预设置） export SEARXNG_SECRET="your-secret-key"
> 2. `uv venv --clear` 创建虚拟环境 > 3. `uv pip install -r requirements.txt` 安装依赖 > 4. 启用 JSON API（修改 `settings.yml`） > 5. 复制 `limiter.toml` 到 `/etc/searxng/`（需要 sudo 或目录已存在） > 6. 生成 secret 并启动服务 ### 验证
| 错误 | 原因 | 解决 | |------|------|------| | `command not found: searxng-search` | symlink 未创建 | `sudo ln -sf <skill_dir>/scripts/searxng_cli.py /usr/local/bin/searxng-search` | | `command not found: uv` | uv 未安装或 PATH 未生效 | Step 2 重新安装，`export PATH="$HOME/.local/bin:$PATH"` | | `TypeError: schema of limiter.toml is invalid` | `/etc/searxng/limiter.toml` 格式错误或为空 | `sudo cp ~/projects/searxng/searx/limiter.toml /etc/searxng/limiter.toml` | | `403 Forbidden` (API 请求) | Bot detection 拦截（缺少 `X-Forwarded-For` header） | 确保 limiter.toml 存在且格式正确（使用源码默认文件）；CLI 已内置 header 处理 |
65/65 vendors flagged this skill as clean.
No suspicious patterns detected.