SearXNG Search CLI (Free, Self-hosted, Auto-deploy, Multi-Channel)

• Outcome: Review
• Latest audit: Sep 15, 2026 · 2:11 AM UTC
• Version: 1.3.0

Overview

This search skill is disclosed as a self-hosted SearXNG installer and CLI, but its setup path executes unverified remote code, installs mutable upstream software, creates persistence, and has unsafe shell/env handling that users should review before installing.

Install only if you are comfortable letting the skill set up and run a local SearXNG service. Review the installer first, avoid running it with sudo except for the documented symlink or directory steps you explicitly approve, pin or verify uv/SearXNG/dependencies where possible, and do not search for secrets or private data because queries may go to SearXNG and upstream search engines.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/searxng_cli.py:98
• Finding: Unverified Remote Installer Is Downloaded and Executed by a Shell<![CDATA[ ## Vulnerability Details **File Location**: `scripts/searxng_cli.py:98-105`; additional installation instructions at `references/ONBOARDING.md:38-47` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```python # 1. 安装 uv if not subprocess.run("which uv", shell=True, capture_output=True).returncode == 0: log("安装 uv...") run('curl -LsSf https://astral.sh/uv/install.sh | sh') uv_path = Path.home() / ".local" / "bin" / "uv" if uv_path.exists(): os.environ["PATH"] = f"{uv_path.parent}:{os.environ['PATH']}" ``` The onboarding documentation recommends the same unsafe pattern through both `curl` and `wget`: ```bash # 尝试 1: curl curl -LsSf https://astral.sh/uv/install.sh | sh export PATH="$HOME/.local/bin:$PATH" # 尝试 2: wget wget -qO- https://astral.sh/uv/install.sh | sh export PATH="$HOME/.local/bin:$PATH" ``` ### Technical Analysis The installation procedure downloads a mutable script from `https://astral.sh/uv/install.sh` and immediately supplies its response body to `sh`. The payload is not pinned to a version, saved for inspection, authenticated with a release signature, or checked against an expected cryptographic digest. HTTPS protects the connection under normal conditions, but it does not establish that the returned script is the same artifact reviewed during this audit. Compromise of the hosting account, domain, CDN, DNS infrastructure, or trusted TLS path could change the effective code executed by the Skill without any modification to this repository. Installing `uv` is relevant to the declared installation functionality, but executing an unverified network response is not the minimum privilege or minimum-trust mechanism necessary to install it. ### Attack Path 1. An attacker compromises or gains influence over the installer endpoint or its delivery infrastructure. 2. The attacker changes the response from `https://astral.sh/uv/install.sh` to include malicio ...[truncated 906 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all `curl | sh` and `wget | sh` installation paths from both code and documentation. 2. Install `uv` through a trusted platform package manager where practical. 3. Otherwise, select a specific `uv` release and download a versioned artifact rather than a mutable installer URL. 4. Verify the artifact using a pinned SHA-256 digest or the publisher's authenticated signature before execution. 5. Save the artifact to a user-owned temporary file with restrictive permissions and fail closed if verification fails. 6. Display the selected version and source to the user and obtain explicit approval before installing executable software. 7. Ensure installation never runs with elevated privileges unless a narrowly scoped operation explicitly requires them. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/searxng_cli.py:143
• Finding: Environment-Controlled Values Are Interpolated into Shell Commands<![CDATA[ ## Vulnerability Details **File Location**: `scripts/searxng_cli.py:143-150`, with input sources at `scripts/searxng_cli.py:16-18` **Vulnerability Type**: OS command injection **Risk Level**: High ### Vulnerable Code The command inputs are read directly from environment variables: ```python SEARXNG_DIR = Path.home() / "projects" / "searxng" SEARXNG_PORT = os.environ.get("SEARXNG_PORT", "8888") SEARXNG_HOST = os.environ.get("SEARXNG_HOST", "127.0.0.1") SEARXNG_SECRET = os.environ.get("SEARXNG_SECRET", "") ``` They are subsequently interpolated into a string interpreted by a shell: ```python cmd = ( f'cd {SEARXNG_DIR} && ' f'SEARXNG_SECRET={env["SEARXNG_SECRET"]} ' f'{SEARXNG_DIR}/.venv/bin/python -m searx.webapp ' f'--host {SEARXNG_HOST} --port {SEARXNG_PORT}' ) subprocess.Popen(cmd, shell=True, env=env, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL) ``` The shared execution helper also consistently enables shell parsing: ```python def run(cmd, check=True, cwd=None): result = subprocess.run(cmd, shell=True, capture_output=True, text=True, cwd=cwd) if check and result.returncode != 0: log(f"Error: {result.stderr}") sys.exit(1) return result ``` ### Technical Analysis `SEARXNG_SECRET`, `SEARXNG_HOST`, and `SEARXNG_PORT` are not validated or shell-escaped before being inserted into `cmd`. Because `subprocess.Popen` is called with `shell=True`, shell separators, substitutions, redirections, and quoting characters contained in these values are interpreted as syntax rather than literal argument data. The secret is especially dangerous because it is placed in shell assignment syntax without quoting. Host and port values are likewise appended directly to command-line options. This design is unnecessary: Python can launch the executable using an argument list, set the working directory through `cwd`, and supply the secret solely through the subprocess environment. ### Attack Path 1. An attacker cause ...[truncated 1270 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Replace the shell command with a direct process invocation: ```python host = validate_host(SEARXNG_HOST) port = str(validate_port(SEARXNG_PORT)) env = os.environ.copy() env["SEARXNG_SECRET"] = SEARXNG_SECRET or env.get( "SEARXNG_SECRET", "devsecret" ) subprocess.Popen( [ str(SEARXNG_DIR / ".venv" / "bin" / "python"), "-m", "searx.webapp", "--host", host, "--port", port, ], shell=False, cwd=SEARXNG_DIR, env=env, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, ) ``` Additionally: 1. Validate the port as an integer from 1 through 65535. 2. Validate the host as an allowed IP address or hostname; default to loopback. 3. Never place secrets in a shell command string or command-line argument. 4. Refactor every `run()` call to accept an argument list with `shell=False`. 5. Use the `cwd` parameter instead of constructing `cd ... && ...`. 6. Where a shell is genuinely unavoidable, apply strict allow-list validation rather than relying only on quoting. ]]>

T08 · Insecure Dependencies

Error

• Location: scripts/searxng_cli.py:107
• Finding: Installation Executes an Unpinned Upstream Repository and Dependency Set<![CDATA[ ## Vulnerability Details **File Location**: `scripts/searxng_cli.py:107-117` **Vulnerability Type**: Unpinned software supply chain **Risk Level**: High ### Vulnerable Code ```python # 2. 克隆 SearXNG if not SEARXNG_DIR.exists(): log("克隆 SearXNG...") SEARXNG_DIR.parent.mkdir(parents=True, exist_ok=True) run(f"git clone --depth 1 https://github.com/searxng/searxng.git {SEARXNG_DIR}") # 3. 创建虚拟环境 + 安装依赖 venv_dir = SEARXNG_DIR / ".venv" log("创建虚拟环境 + 安装依赖...") run(f"cd {SEARXNG_DIR} && uv venv .venv --clear") run(f"cd {SEARXNG_DIR} && uv pip install -r requirements.txt") ``` ### Technical Analysis The installer clones the current default branch of `searxng/searxng` with no tag, commit identifier, signature verification, or source digest. It then installs the dependency set supplied by that newly downloaded repository and runs the resulting application. Consequently, the effective code installed by a reviewed Skill version can change over time. A malicious or compromised upstream commit can modify application code or dependency declarations. Dependency installation and later service startup turn those mutable upstream inputs into executable local code. The source URL is the expected public SearXNG repository rather than an obvious typosquatted package. The weakness is therefore lack of reproducibility and integrity pinning, not evidence that the current upstream project is malicious. ### Attack Path 1. An attacker compromises the upstream SearXNG repository, a maintainer account, or a referenced dependency source. 2. Malicious code or a malicious dependency version is introduced into the default branch or requirements. 3. A user invokes `searxng-search install`. 4. The installer clones the current default branch without checking an expected commit. 5. `uv pip install -r requirements.txt` resolves and installs the supplied dependency set. 6. Malicious code executes during package installation, import, or SearXNG service startup. ### Impa ...[truncated 497 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin SearXNG to a specific reviewed commit or authenticated release tag. 2. Verify a signed release or compare the fetched commit to a hardcoded expected commit ID before installation. 3. Maintain a lockfile that pins transitive dependency versions and includes cryptographic hashes. 4. Configure the installer to fail if a dependency does not match an approved hash. 5. Separate download, verification, dependency installation, and startup into explicit stages. 6. Display the exact SearXNG commit and dependency-lock version before executing installed code. 7. Provide a deliberate update command that reviews and changes pins rather than silently retrieving the latest branch during every fresh installation. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/searxng_cli.py:238
• Finding: Forged Localhost Trust Header and Plaintext HTTP Are Used for Configurable Destinations<![CDATA[ ## Vulnerability Details **File Location**: `scripts/searxng_cli.py:21-23,238-242`; related example at `references/ONBOARDING.md:104` **Vulnerability Type**: Access-control bypass and plaintext query transmission **Risk Level**: Medium ### Vulnerable Code ```python # Bot detection bypass: 127.0.0.1 is in trusted_proxies by default FORWARDED_FOR = {"X-Forwarded-For": "127.0.0.1"} ``` The header is sent to the destination selected through the configurable host: ```python from urllib.parse import urlencode url = f"http://{SEARXNG_HOST}:{SEARXNG_PORT}/search?{urlencode(params)}" try: req = urllib.request.Request(url, headers=FORWARDED_FOR) with urllib.request.urlopen(req, timeout=10) as resp: data = json.load(resp) ``` The onboarding instructions duplicate the trust-header behavior: ```bash curl -s -H "X-Forwarded-For: 127.0.0.1" "http://127.0.0.1:8888/search?q=test&format=json" | python3 -m json.tool | head -10 ``` ### Technical Analysis The CLI intentionally identifies every request as originating from `127.0.0.1` through `X-Forwarded-For`, because localhost is treated as trusted by the expected limiter configuration. This may be appropriate only when directly connecting to a service verified to be bound to the same machine. However, `SEARXNG_HOST` is configurable, and no loopback check prevents the same forged header from being sent to a remote server. If a remote SearXNG or reverse proxy trusts client-supplied forwarding headers, the request may incorrectly receive localhost-specific exemptions, including limiter or bot-detection bypasses. Trust decisions should be made by a controlled reverse proxy, not by an arbitrary client asserting its own source identity. The URL scheme is always `http://`. If a non-loopback host is configured, the search query is included in the plaintext request URL and may be observed or modified by systems on the network path. Search terms can contain confidential project names, vulnerability resear ...[truncated 1352 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Parse and validate `SEARXNG_HOST` before constructing requests. 2. Add `X-Forwarded-For: 127.0.0.1` only when the resolved destination is strictly loopback and the connection is direct. 3. Prefer removing the spoofed forwarding header and configuring SearXNG's limiter correctly for direct local API access. 4. Never send a self-asserted trusted proxy header to a remote destination. 5. Support a complete configurable base URL rather than hardcoding `http://`. 6. Require HTTPS for all non-loopback destinations and validate certificates normally. 7. Consider sending search parameters in a POST body where supported to reduce query exposure in URL logs; HTTPS remains required. 8. Document that search queries are transmitted to SearXNG and, through its declared metasearch operation, may be relayed to selected upstream search engines. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (56)

Tainted flow: 'req' from os.environ.get (line 46, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

f"http://{SEARXNG_HOST}:{SEARXNG_PORT}",
                headers=FORWARDED_FOR
            )
            resp = urllib.request.urlopen(req, timeout=3)
            return resp.status == 200
        except:
            import time

• Confidence: 93% confidence
• Finding: The request target is built from environment-controlled host and port values and then fetched, enabling outbound requests to arbitrary local or remote destinations. In an agent skill, this can be abused for SSRF-style probing of internal services or unintended network access beyond the stated search purpose.

Tainted flow: 'req' from os.environ.get (line 46, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

try:
        req = urllib.request.Request(url, headers=FORWARDED_FOR)
        with urllib.request.urlopen(req, timeout=10) as resp:
            data = json.load(resp)

        results = data.get("results", [])

• Confidence: 94% confidence
• Finding: Search requests are sent to a URL whose base host and port come from environment variables, allowing an attacker to redirect the client to arbitrary services. That can expose the skill as a network primitive for internal scanning or querying attacker-chosen endpoints while spoofing a trusted header.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared purpose is web search, but the documented behavior includes software installation, local configuration changes, service lifecycle management, secret generation, and process termination. This mismatch is dangerous because users or orchestrators may invoke the skill expecting low-risk search behavior while it performs privileged system administration actions with persistence and network side effects.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared purpose is web search, but the documented behavior includes software installation, local configuration changes, service lifecycle management, secret generation, and process termination. This mismatch is dangerous because users or orchestrators may invoke the skill expecting low-risk search behavior while it performs privileged system administration actions with persistence and network side effects.

Chaining Abuse

High

• Category: Tool Misuse

Content

### 安装
```bash
# 尝试 1: curl
curl -LsSf https://astral.sh/uv/install.sh | sh
export PATH="$HOME/.local/bin:$PATH"

# 尝试 2: wget

• Confidence: 97% confidence
• Finding: Piping a network response directly into sh is a classic dangerous chaining pattern because it combines retrieval and execution into a single opaque step. In a skill onboarding document, this is especially risky since agents or users may run it without inspection.

Chaining Abuse

High

• Category: Tool Misuse

Content

export PATH="$HOME/.local/bin:$PATH"

# 尝试 2: wget
wget -qO- https://astral.sh/uv/install.sh | sh
export PATH="$HOME/.local/bin:$PATH"

# 尝试 3: 如果 PATH 未生效

• Confidence: 97% confidence
• Finding: This wget-to-sh pipeline has the same dangerous chaining property as the curl variant, enabling immediate execution of remotely supplied content. It reduces visibility and bypasses normal review safeguards, raising supply-chain risk.

Chaining Abuse

High

• Category: Tool Misuse

Content

chmod +x <skill_dir>/scripts/searxng_cli.py

# 创建 symlink（如果不存在）
which searxng-search || sudo ln -sf <skill_dir>/scripts/searxng_cli.py /usr/local/bin/searxng-search

# 设置 secret（安装时会自动生成，也可预设置）
export SEARXNG_SECRET="your-secret-key"

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

External Script Fetching

High

• Category: Supply Chain

Content

期望输出：搜索结果列表（标题 + URL + 摘要）

```bash
curl -s -H "X-Forwarded-For: 127.0.0.1" "http://127.0.0.1:8888/search?q=test&format=json" | python3 -m json.tool | head -10
```
期望输出：有效 JSON（`"query": "test"` + `"results": [...]`）

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

| `connection refused` | 服务未启动 | `searxng-search start` |
| `启动失败` (install/start 超时) | 服务启动慢或端口被占用 | 等待 20-30s 后重试 `searxng-search status`；检查端口：`ss -tlnp | grep 8888` |
| 搜索返回空结果 | 所有引擎被封/超时 | 部分引擎被封属正常现象，尝试换关键词或指定引擎 `--engine brave` |
| `No module named 'xxx'` | venv 依赖缺失 | `rm -rf ~/projects/searxng/.venv && searxng-search install` |
| `Permission denied: /home/node/projects` | 目录无写入权限 | `sudo mkdir -p ~/projects && sudo chown $(whoami) ~/projects` |
| `pip: not found` (旧版 install) | uv venv 不自带 pip | 确保使用最新版 CLI 脚本（v1.2.0+，已改用 `uv pip install`） |
| 端口 8888 被占用 | 其他服务占用 | `SEARXNG_PORT=9999 searxng-search start` |

• Confidence: 90% confidence
• Finding: The troubleshooting guidance includes rm -rf on a path under the user's home directory. While targeted at a virtual environment, recursive forced deletion is still destructive if variables, path expansion, or copy/paste mistakes occur, and agent execution makes such mistakes more consequential.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

| `connection refused` | 服务未启动 | `searxng-search start` |
| `启动失败` (install/start 超时) | 服务启动慢或端口被占用 | 等待 20-30s 后重试 `searxng-search status`；检查端口：`ss -tlnp | grep 8888` |
| 搜索返回空结果 | 所有引擎被封/超时 | 部分引擎被封属正常现象，尝试换关键词或指定引擎 `--engine brave` |
| `No module named 'xxx'` | venv 依赖缺失 | `rm -rf ~/projects/searxng/.venv && searxng-search install` |
| `Permission denied: /home/node/projects` | 目录无写入权限 | `sudo mkdir -p ~/projects && sudo chown $(whoami) ~/projects` |
| `pip: not found` (旧版 install) | uv venv 不自带 pip | 确保使用最新版 CLI 脚本（v1.2.0+，已改用 `uv pip install`） |
| 端口 8888 被占用 | 其他服务占用 | `SEARXNG_PORT=9999 searxng-search start` |

• Confidence: 90% confidence
• Finding: The troubleshooting guidance includes rm -rf on a path under the user's home directory. While targeted at a virtual environment, recursive forced deletion is still destructive if variables, path expansion, or copy/paste mistakes occur, and agent execution makes such mistakes more consequential.

Chaining Abuse

High

• Category: Tool Misuse

Content

| `启动失败` (install/start 超时) | 服务启动慢或端口被占用 | 等待 20-30s 后重试 `searxng-search status`；检查端口：`ss -tlnp | grep 8888` |
| 搜索返回空结果 | 所有引擎被封/超时 | 部分引擎被封属正常现象，尝试换关键词或指定引擎 `--engine brave` |
| `No module named 'xxx'` | venv 依赖缺失 | `rm -rf ~/projects/searxng/.venv && searxng-search install` |
| `Permission denied: /home/node/projects` | 目录无写入权限 | `sudo mkdir -p ~/projects && sudo chown $(whoami) ~/projects` |
| `pip: not found` (旧版 install) | uv venv 不自带 pip | 确保使用最新版 CLI 脚本（v1.2.0+，已改用 `uv pip install`） |
| 端口 8888 被占用 | 其他服务占用 | `SEARXNG_PORT=9999 searxng-search start` |

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Intent-Code Divergence

High

• Confidence: 100% confidence
• Finding: The code explicitly documents and implements a bot-detection bypass by sending X-Forwarded-For: 127.0.0.1 to appear as a trusted proxy/local client. This is an intentional trust-boundary bypass and makes the skill more dangerous because it is designed to evade protections rather than merely perform search.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

def run(cmd, check=True, cwd=None):
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True, cwd=cwd)
    if check and result.returncode != 0:
        log(f"Error: {result.stderr}")
        sys.exit(1)

• Confidence: 97% confidence
• Finding: This helper exposes a shell-executing primitive that can be reused across commands, increasing the chance of tool parameter abuse when any input becomes attacker-controlled. In an agent skill that already performs installation and service management, such a primitive materially raises exploitation risk.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill claims to be a search CLI but also installs software, edits configuration, launches services, stops processes, and enables persistence. This mismatch materially increases risk because invoking a seemingly simple search skill can trigger broad system changes and code execution paths users would not expect.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The installer clones a repository, creates a virtualenv, installs dependencies, and executes a remote shell installer for uv. For a search skill, this is dangerous overreach because it executes substantial unverified code and changes the host system well beyond user search functionality.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

log("开始安装 SearXNG...")

    # 1. 安装 uv
    if not subprocess.run("which uv", shell=True, capture_output=True).returncode == 0:
        log("安装 uv...")
        run('curl -LsSf https://astral.sh/uv/install.sh | sh')
        uv_path = Path.home() / ".local" / "bin" / "uv"

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Piping a remotely fetched script directly into sh executes network-supplied code immediately, with no integrity verification or meaningful user warning. In an agent skill this is especially dangerous because it turns routine use into remote code execution on the host.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

return

    log("启动服务...")
    env = os.environ.copy()
    env["SEARXNG_SECRET"] = SEARXNG_SECRET or env.get("SEARXNG_SECRET", "devsecret")

    cmd = (

• Confidence: 60% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

f'{SEARXNG_DIR}/.venv/bin/python -m searx.webapp '
        f'--host {SEARXNG_HOST} --port {SEARXNG_PORT}'
    )
    subprocess.Popen(cmd, shell=True, env=env, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)

    import time
    for _ in range(15):

• Confidence: 99% confidence
• Finding: This duplicate finding points to the same unsafe Popen(shell=True) sink and the same abuse path: attacker-influenced parameters can escape into shell syntax. The skill context amplifies impact because the command runs as part of service lifecycle management on the local host.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

f'{SEARXNG_DIR}/.venv/bin/python -m searx.webapp '
        f'--host {SEARXNG_HOST} --port {SEARXNG_PORT}'
    )
    subprocess.Popen(cmd, shell=True, env=env, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)

    import time
    for _ in range(15):

• Confidence: 99% confidence
• Finding: This duplicate finding points to the same unsafe Popen(shell=True) sink and the same abuse path: attacker-influenced parameters can escape into shell syntax. The skill context amplifies impact because the command runs as part of service lifecycle management on the local host.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The README describes search capability but does not warn users that their queries may be transmitted to a self-hosted SearXNG server and then to third-party upstream engines. This omission is risky because users may enter sensitive data under the assumption the request stays local to the agent, causing unintentional disclosure of private prompts, credentials, internal project names, or research topics.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger examples are broad natural-language requests like ordinary chat queries, which increases the chance the agent will invoke the skill when the user did not explicitly intend to send a search query to this integration. In this skill's context, accidental invocation can leak user prompts or sensitive research topics to a self-hosted SearXNG instance and potentially onward to upstream search engines.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

searxng-search-cli/
├── .claude-plugin/plugin.json
├── .codex-plugin/plugin.json
├── skills/searxng-search-cli/SKILL.md
├── SKILL.md
├── scripts/searxng_cli.py
└── references/ONBOARDING.md

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill advertises operational capabilities that imply shell, network, environment, and file-modifying behavior, but it does not declare any explicit tool scope or permission boundary. That makes the effective trust surface opaque to users and host platforms, increasing the chance that a simple 'search' skill can unexpectedly install software, alter configuration, or invoke networked commands without informed consent.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

---
name: searxng-search-cli
displayName: "SearXNG Search CLI (Free, Self-hosted, Auto-deploy, Multi-Channel)"
version: 1.3.0
description: |
  Use self-hosted SearXNG search engine (Free, Self-hosted, Auto-deploy, Multi-Channel). SearXNG is a free meta search engine that aggregates 200+ search engines (Google, Bing, Brave, GitHub, etc.), completely free and self-hostable.

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.