Duckduckgo Search 1.0.0

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:32 PM UTC
• Version: 1.0.0

Overview

This DuckDuckGo search skill is coherent, but it grants broad Python and package-install permissions beyond a narrow web-search workflow.

Review before installing. Use this only in an isolated Python environment if you are comfortable granting the skill broad Python execution and package-install authority, and prefer pinning the dependency version before use.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:24

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 24-27
Vulnerability Type: Supply-chain exposure through an unpinned dependency
Risk Level: Medium

bash

uv pip install duckduckgo-search

pip install duckduckgo-search

Technical Analysis

The installation instructions retrieve duckduckgo-search from the package index configured for pip or uv without specifying an exact version, cryptographic hash, lockfile, or trusted index. Consequently, the code installed by these commands can change after the Skill has been reviewed.

If a future release, transitive dependency, package-index account, or configured package source is compromised, installation or subsequent import of the package could run attacker-controlled code. Source distributions and malicious build backends may also execute code during package building.

The project contains no evidence that the named package is currently malicious. The finding concerns the unsafe and non-reproducible dependency acquisition process.

Attack Path

1. A user or Agent follows the documented installation instructions.
2. pip or uv resolves the latest compatible package and dependencies from the configured package index.
3. An attacker compromises a future package release, a transitive dependency, or the configured package source.
4. The package manager downloads and installs the attacker-controlled artifact.
5. Malicious code executes during a source build or when the installed module is imported by the documented search commands.

Impact Assessment

Attacker-controlled package code would generally execute with the privileges of the user running pip, uv, or Python. It could access that user's files and environment variables, alter writable project or environment files, initiate network connections, and execute additional processes. If installation is performed in a privileged system environment, the impact could extend to all files and services writ ...[truncated 32 chars]

Remediation

View remediation

Remediation Suggestions

• Pin duckduckgo-search to a specifically reviewed version rather than resolving the latest release.
• Maintain a lockfile that also pins all transitive dependencies.
• Require cryptographic hashes for downloaded artifacts, such as with pip's hash-checking mode.
• Configure an explicitly approved package index or internal artifact repository.
• Prefer pre-reviewed binary wheels and carefully review any source distribution or build backend.
• Separate dependency installation from normal Skill execution and avoid granting package-manager access at runtime.
• Add automated dependency scanning and a controlled process for reviewing and updating pinned versions.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:4

Finding

Overly Broad Bash, Python, and Package-Manager Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 4
Vulnerability Type: Excessive tool authorization and violation of least privilege
Risk Level: Medium

yaml

allowed-tools: Bash(duckduckgo-search:*), Bash(python:*), Bash(pip:*), Bash(uv:*)

Technical Analysis

The Skill authorizes arbitrary argument patterns for Python, pip, and uv through Bash. In particular, Bash(python:*) provides a general-purpose local code-execution capability rather than a narrowly scoped search operation. The pip and uv permissions likewise permit package-management operations beyond the Skill's legitimate requirement to submit search queries.

General Python execution can read and modify files available to the Agent account, inspect environment variables, create network connections, and launch subprocesses. Package-manager access can install arbitrary packages or alter the active environment. These capabilities substantially exceed the minimum permissions needed for a DuckDuckGo search wrapper.

The reviewed Skill text does not itself direct the Agent to abuse these permissions. Exploitation would require a malicious or mistaken instruction, such as an untrusted prompt or content influencing the command the Agent selects.

Attack Path

1. Loading the Skill makes the broad Bash permission patterns available.
2. A malicious prompt, indirect instruction, or Agent error causes the construction of a Python, pip, or uv command unrelated to the intended search operation.
3. The command passes the broad prefix-based authorization rule.
4. Python executes arbitrary local logic, or a package manager installs attacker-selected code.
5. The resulting code operates with the filesystem, process, environment, and network access available to the Agent's operating-system account.

Impact Assessment

Successful abuse could expose files and environment variables readable by the Agent account, modify writable files, install packag ...[truncated 279 chars]

Remediation

View remediation

Remediation Suggestions

• Replace general Bash(python:*), Bash(pip:*), and Bash(uv:*) authorization with a dedicated, narrowly scoped search tool.
• Implement a reviewed wrapper that accepts only a search query and a strict allowlist of supported parameters.
• Validate query length, parameter types, result limits, region codes, and search modes before making requests.
• Pass arguments through structured APIs rather than constructing shell command strings.
• Remove package-manager permissions from runtime operation and install pinned dependencies during a separate controlled deployment step.
• Run the wrapper in a restricted environment with minimal filesystem access, no unnecessary credentials, constrained network egress, and resource limits.
• If Python execution is unavoidable, authorize only a fixed script path rather than unrestricted inline Python commands.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Granting Bash(python:*) provides arbitrary interpreter execution, not just DuckDuckGo queries. In this context, the examples use inline Python snippets, so a caller could repurpose the skill to run unrelated local code, access files, or chain with other shell capabilities, making the skill materially more dangerous than its declared function suggests.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Granting Bash(python:*) provides arbitrary interpreter execution, not just DuckDuckGo queries. In this context, the examples use inline Python snippets, so a caller could repurpose the skill to run unrelated local code, access files, or chain with other shell capabilities, making the skill materially more dangerous than its declared function suggests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill documentation switches into Chinese and presents all operational guidance in that language, with no indication that users may choose another language or locale. This creates a language/locale policy issue because the skill effectively imposes a specific language without opt-in.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest frames the skill as retrieving real-time information from the internet, which implies search and result retrieval. The documented example additionally writes search results to a timestamped local file, introducing local persistence behavior not mentioned in the description and not obviously required for basic search functionality.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.