Searxng Backup

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:01 AM UTC
• Version: 1.0.0

Overview

This search skill does what it advertises, but it needs Review because broad triggers and disabled HTTPS checks can send or expose searches unexpectedly.

Install only if you intend broad search prompts to use your configured SearXNG instance. Prefer a local/private SearXNG server, avoid sending secrets or sensitive regulated data as search terms, and treat remote/public HTTPS instances as risky until TLS verification is enabled or a trusted CA bundle is configured. Review dependency pinning and consider narrowing triggers before enabling it in a shared or sensitive environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/searxng.py:59

Finding

TLS Certificate Verification Disabled for All SearXNG Connections

Content

View full analysis

Vulnerability Details

File Location: scripts/searxng.py:59-66
Additional Location: scripts/searxng.py:20
Vulnerability Type: Improper certificate validation
Risk Level: High

Vulnerable Code

python

# Suppress SSL warnings for local self-signed certificates
warnings.filterwarnings('ignore', message='Unverified HTTPS request')

python

try:
    # Disable SSL verification for local self-signed certs
    response = httpx.get(
        f"{SEARXNG_URL}/search",
        params=params,
        timeout=30,
        verify=False  # For local self-signed certs
    )

Technical Analysis

The HTTP client unconditionally uses verify=False, disabling TLS certificate-chain and hostname validation for every configured SearXNG endpoint. The implementation does not limit this behavior to loopback endpoints or explicitly trusted self-signed certificates.

Consequently, an HTTPS connection can be established through a forged, expired, self-signed, or otherwise invalid certificate. Suppressing unverified-request warnings at line 20 further obscures the insecure connection state. The documentation reinforces this configuration in README.md:128-139 by recommending verify=False and curl -k.

Attack Path

1. A user configures SEARXNG_URL with an HTTPS endpoint, including a public or remotely hosted instance.
2. An attacker gains a network interception position, such as through a malicious access point, compromised router, DNS manipulation, or hostile proxy.
3. The attacker presents an invalid or attacker-controlled TLS certificate.
4. Because verify=False is set, the client accepts the certificate without authenticating the server.
5. The attacker reads search queries and returns modified SearXNG JSON responses.
6. Manipulated titles, snippets, and URLs are displayed to the user or consumed by downstream automation.

Impact Assessment

This flaw compromises the c ...[truncated 433 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove verify=False and use certificate verification by default:

   python

   response = httpx.get(
       f"{SEARXNG_URL}/search",
       params=params,
       timeout=30,
       verify=True,
   )
   

2. If self-signed certificates must be supported, accept a configurable CA certificate bundle rather than disabling verification:

   python

   ca_bundle = os.getenv("SEARXNG_CA_BUNDLE", True)
   
   response = httpx.get(
       f"{SEARXNG_URL}/search",
       params=params,
       timeout=30,
       verify=ca_bundle,
   )
   

3. If an insecure mode remains necessary, require an explicit opt-in setting, clearly warn the user, and restrict it to loopback or otherwise validated local addresses.

4. Remove global warning suppression so insecure TLS states remain visible.

5. Update README.md to recommend installing or configuring the correct CA certificate instead of using verify=False or curl -k.

6. Add tests confirming that invalid certificates are rejected by default.

T08 · Insecure Dependencies

Warning

• Location: scripts/searxng.py:2

Finding

Unpinned Dependencies Are Resolved at Runtime

Content

View full analysis

Vulnerability Details

File Location: scripts/searxng.py:2-5
Related Execution Instructions: SKILL.md:23-38
Vulnerability Type: Unconstrained third-party dependency resolution
Risk Level: Medium

Vulnerable Code

python

# /// script
# requires-python = ">=3.11"
# dependencies = ["httpx", "rich"]
# ///

The documented invocation uses runtime dependency resolution:

bash

uv run {baseDir}/scripts/searxng.py search "query"

Technical Analysis

The PEP 723 dependency declaration identifies httpx and rich without exact versions, hashes, or an accompanying reviewed lockfile. Running the script through uv run can therefore resolve and install package versions available from the configured package index at execution time.

This makes the effective executable dependency set mutable after the skill itself has been reviewed. Although no evidence shows that the named packages are currently malicious, unconstrained resolution creates a supply-chain exposure: a compromised upstream release, package-index compromise, or unexpectedly incompatible future version could be selected without a corresponding change to this repository.

Attack Path

1. An attacker compromises an upstream dependency release, its publisher account, the package index, or the user's configured package source.
2. A malicious or altered version remains compatible with the unconstrained dependency names.
3. The user invokes the documented uv run command in an environment where that version has not already been securely locked and cached.
4. The resolver downloads and installs the attacker-controlled version.
5. Python executes dependency initialization code when httpx or rich is imported.
6. The malicious package executes with the same operating-system permissions and environmental access as the user running the skill.

Impact Assessment

Successful supply-chain exploitation could permit arb ...[truncated 473 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin each dependency to a reviewed exact version:

   python

   # /// script
   # requires-python = ">=3.11"
   # dependencies = [
   #   "httpx==<reviewed-version>",
   #   "rich==<reviewed-version>",
   # ]
   # ///
   

2. Generate and commit a lockfile that records the complete transitive dependency graph.

3. Require package hashes where supported so downloaded artifacts are integrity-checked.

4. Use a trusted or organization-controlled package mirror and restrict fallback to unapproved indexes.

5. Add automated dependency scanning and controlled update review.

6. Test dependency updates before changing pinned versions, and document the reviewed versions in release artifacts.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (15)

Tainted flow: 'SEARXNG_URL' from os.getenv (line 23, credential/environment) → httpx.get (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/searxng.py (reported line 61)May include surrounding context.

python

try:
        # Disable SSL verification for local self-signed certs
        response = httpx.get(
            f"{SEARXNG_URL}/search",
            params=params,
            timeout=30,

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · PUBLISHING_CHECKLIST.md (reported line 78)May include surrounding context.

md

1. **Review all files** - Make sure everything is polished
2. **Test one more time** - Fresh installation test
3. **Version bump if needed** - Update SKILL.md, metadata.json, CHANGELOG.md
4. **Git commit** - Clean commit message
5. **Submit to ClawdHub** - Follow ClawdHub submission process
6. **Monitor feedback** - Be ready to address issues

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 60% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 138)May include surrounding context.

1. Check your SearXNG instance is running:

   bash

   curl -k $SEARXNG_URL
   # Or: curl -k http://localhost:8080 (default)
   

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · PUBLISH.md (reported line 117)May include surrounding context.

md

If you make changes later:

1. Update version in SKILL.md and metadata.json
2. Add entry to CHANGELOG.md
3. Run: `clawdhub publish skills/searxng`

### Manage Your Skill

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The README explicitly states the skill is configured with verify=False, meaning HTTPS certificate validation is disabled by default. This permits man-in-the-middle interception or modification of search queries and responses, which is especially dangerous because the skill is network-facing and may be used with non-local or public SearXNG instances.

Content

Scanner excerpt · README.md (reported line 128)May include surrounding context.

md

## SSL/TLS Notes

The skill is configured to work with self-signed certificates (common for local SearXNG instances). If you need strict SSL verification, edit the script and change `verify=False` to `verify=True` in the httpx request.

## Troubleshooting

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill invokes a Python script that uses environment configuration and performs network access, but the manifest does not declare any explicit tool scope such as permissions or allowed-tools. This weakens reviewability and policy enforcement because the runtime capabilities are broader than what the manifest communicates, making it easier for networked behavior to be introduced or changed without clear user/admin approval.

Content

No source excerpt is available for this finding.

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 88% confidence

Finding

The trigger 'search for' closely overlaps with a built-in 'search' command, creating shadowing risk where this skill may intercept requests intended for core functionality. Because the skill issues network-backed searches, this can redirect user actions and data flow unexpectedly, especially if users assume they are invoking trusted built-in behavior.

Content

No source excerpt is available for this finding.

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 88% confidence

Finding

The trigger 'search web' conflicts with a likely built-in 'search' capability and may capture common requests unexpectedly. In this skill's context, that means user queries can be routed to the configured external/local search endpoint without clear intent, which is a meaningful security and trust issue.

Content

No source excerpt is available for this finding.

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 86% confidence

Finding

The trigger 'find information' overlaps with a built-in 'find' command and is broad enough to match normal conversation. That increases the chance of unintended activation and unexpected network requests, especially in a search skill whose purpose is to fetch external information.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger phrases are generic conversational language like 'search for' and 'find information', which can cause the skill to activate unintentionally during ordinary user requests. In a skill that performs networked searches, accidental activation can leak user queries to the configured SearXNG instance or override expected built-in behavior.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

TLS certificate verification is explicitly disabled with verify=False, which allows man-in-the-middle interception or modification of search traffic when HTTPS is used. In this skill, user search terms and returned results could be observed or tampered with by a network attacker, undermining both privacy and integrity.

Content

Scanner excerpt · scripts/searxng.py (reported line 65)May include surrounding context.

python

f"{SEARXNG_URL}/search",
            params=params,
            timeout=30,
            verify=False  # For local self-signed certs
        )
        response.raise_for_status()

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README emphasizes privacy benefits but does not clearly disclose that user queries are transmitted to the configured SearXNG instance and may be forwarded to upstream search engines, especially when using public instances. This can mislead users about the true privacy boundary and cause unintended disclosure of sensitive search terms.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The documentation includes an example that hard-codes --language en, which can imply an English-only default behavior without any note that language is user-selectable. Because no opt-in or locale rationale is provided alongside this example, it may conflict with language/locale choice expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This code performs an HTTP request to a SearXNG instance using the user's search query, which is a network transmission of user-provided data. Although network access is central to the tool's purpose, there is no explicit disclosure in user-facing output or help that queries will be sent to the configured instance, so users may not realize their input leaves the local process.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.