T09 · Insecure Skill Coding Practices
Error
- Location
scripts/searxng.py:94- Finding
Search Queries and Responses Are Exposed to Network Interception
- Content
View full analysis
- Remediation
View remediation
Security audit
My Searxng
Security checks for vulnerabilities and agentic risk
Overview
This is a real SearXNG search skill, but it needs review because it can route broad search requests through an insecure or non-local endpoint.
Review before installing. Use this only with a SearXNG endpoint you control, prefer HTTPS with proper certificate validation, replace the bundled URL, and narrow the triggers so routine search requests are not silently routed through this skill. Treat all returned titles, URLs, and snippets as untrusted web content.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T01 · Skill Instruction Hijacking
Warning
- Location
scripts/searxng.py:124- Finding
Untrusted Search-Result Content Is Emitted Directly into Agent-Visible Output
- Content
View full analysis
52 else title url = result.get("url", "") print(f"{i:<4} {display_title:<55} {url}") # Detailed Snippets for Top 3 results print("\n--- TOP RESULT DETAILS ---") for i, result in enumerate(results[:3], 1): print(f"\n[{i}] {result.get('title')}") print(f" URL: {result.get('url')}") # Clean up snippet content: remove newlines and extra spaces content = result.get('content', '').strip().replace('\n', ' ') if content: print(f" Snippet: {content[:300]}...") ``` ### Technical Analysis Search-result titles, URLs, and snippets originate from external websites and are therefore attacker-controlled data. The script prints these fields directly into output designed for AI consumption. Removing newline characters from snippets does not neutralize natural-language instructions, deceptive URLs, or terminal control characters. A malicious page can include text such as instructions to ignore prior constraints, disclose information, or invoke another tool. If that text is indexed and returned in a result title or snippet, it becomes part of the Agent's context without an explicit trust-boundary warning. A forged or compromised SearXNG response can produce the same result. ### Attack Path 1. An attacker publishes a page containing instruction-like content in its title, metadata, or body. 2. The attacker targets search terms likely to be used by the victim and attempts to have the pa ...[truncated 1172 chars]- Remediation
View remediation
Vulnerability Patterns
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
The README explicitly recommends
curl -k, which disables TLS certificate verification. Combined with the stated behavior of bypassing SSL verification (ssl.CERT_NONE), this normalizes insecure transport and makes man-in-the-middle interception or redirection of search traffic much easier, especially if users point the skill at non-local or public SearXNG instances.- Content
bash # Use your configured URL from searxng.ini curl -k http://your-searxng-instance.com:port- Verify the URL in your searxng.ini config file
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 75% confidence
- Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The README uses very broad activation phrases such as generic 'Search' examples, and the skill metadata includes many unconstrained triggers like 'look up', 'find information', and common Chinese web-search phrases. In an agent environment, broad triggers can cause unintended tool invocation, sending sensitive user text to the configured search backend when the user did not clearly intend web access.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
url = http://your-searxng-instance.com:port
text Note: If the configuration file does not exist or is missing required settings, the script will automatically create a default configuration file and prompt you to modify it. ## Direct CLI Usage
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill instructs execution of a Python script that performs network access and may create a local configuration file, but it declares no explicit tool scope or permissions. This weakens least-privilege controls and makes the skill easier to over-grant or invoke in environments where users and orchestrators cannot clearly assess its capabilities.
- Content
Shadow Command Trigger
Medium
- Category
- Trigger Abuse
- Confidence
- 87% confidence
- Finding
The trigger 'search for' overlaps with a built-in search command, creating a shadowing risk where this third-party skill may capture intents meant for trusted native functionality. In a network-enabled skill, that can redirect queries, alter outputs, or expose user requests to a different backend than expected.
- Content
Shadow Command Trigger
Medium
- Category
- Trigger Abuse
- Confidence
- 87% confidence
- Finding
The trigger 'search web' is highly similar to a built-in search capability and may intercept common user intents. Because this skill issues outbound requests to a configured SearXNG instance, users may unknowingly route searches through an alternate service, changing privacy and trust assumptions.
- Content
Shadow Command Trigger
Medium
- Category
- Trigger Abuse
- Confidence
- 84% confidence
- Finding
The trigger 'find information' is broad and conflicts with generic built-in discovery behavior, increasing the chance of unintended interception. In this context, accidental routing to a networked custom skill can lead to unanticipated data exposure and inconsistent results compared with trusted built-ins.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger set includes broad everyday phrases such as 'look up', '帮我查', and '搜一下', which can cause accidental activation in unrelated conversations. Unintended invocation is risky here because the skill can initiate network requests and potentially create local files, expanding the attack surface without deliberate user intent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The document includes imperative AI instructions written in Chinese such as "AI 必读" and "AI 约束," directing required behavior without offering a user language choice. This can constitute a language/locale policy issue because the skill embeds mandatory non-user-selected language guidance rather than presenting language preferences as optional.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The manifest description frames the skill as operating through 'your local SearXNG instance', but the code accepts any URL from searxng.ini and does not enforce localhost or other local-only endpoints. That means the actual behavior can route searches to external SearXNG servers, which is broader than the stated local-instance scope.
- Content