searxng-auto-proxy searxng自适应代理检测

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:28 PM UTC
• Version: 3.0.0

Overview

The skill is mostly coherent for automating SearXNG proxy selection, but it can run as a long-lived root-scoped process and automatically change Clash proxy routing without strong scoping or authentication controls.

Review before installing. Use only in an isolated SearXNG/Clash deployment, pin dependencies and container images, protect the Clash controller with authentication and network restrictions, run the adapter as a dedicated unprivileged user, and configure proxy switching only for a SearXNG-specific proxy group.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned Third-Party Dependencies and Mutable Container Images

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-4; README.md:40-41; SKILL.md:196-202, 215-219, 455-472
Vulnerability Type: Supply-chain exposure through unpinned dependencies and mutable artifacts
Risk Level: Medium

Vulnerable Code

requirements.txt:1-4:

text

# Core dependencies
requests>=2.28.0
numpy>=1.20.0
pyyaml>=6.0

README.md:40-41:

bash

# 1. Install dependencies
pip3 install aiohttp pyyaml

Relevant installation commands in SKILL.md include:

bash

pip install -r requirements.txt
docker pull pengong101/searxng-auto-proxy:latest
pip install searxng-auto-proxy

Technical Analysis

The dependency file permits any version at or above the specified minimum. It does not provide exact versions, integrity hashes, or a lock file. In addition, adapter.py imports aiohttp, but aiohttp is absent from requirements.txt. The documentation instead instructs users to install it directly without a version constraint.

The Skill documentation also recommends pulling a personal container image using the mutable latest tag. Consequently, the executable artifact received by a user can change after this audited package has been reviewed.

This does not prove that any current dependency or container is malicious. However, it creates a supply-chain execution path through compromised publisher accounts, malicious future releases, dependency takeover, or incompatible upstream updates.

Attack Path

1. An attacker compromises an upstream package publisher, package registry account, or container registry account.
2. The attacker publishes a malicious version satisfying a broad requirement such as pyyaml>=6.0, or replaces the image referenced by the latest tag.
3. A user follows the documented pip install or docker pull instructions.
4. The package installation process or downloaded container executes attacker-controlled code.
5. The ma ...[truncated 755 chars]

Remediation

View remediation

Remediation Suggestions

1. Add every runtime dependency, including aiohttp, to a single authoritative dependency file.
2. Pin dependencies to exact audited versions rather than minimum versions.
3. Generate and verify cryptographic hashes, for example with pip-compile --generate-hashes, and install with pip --require-hashes.
4. Maintain a reproducible lock file and update it through a reviewed dependency-upgrade process.
5. Pin container images by immutable digest, such as image@sha256:..., instead of using latest.
6. Verify the ownership and provenance of PyPI and container registry artifacts.
7. Run dependency vulnerability and software-bill-of-materials scans in CI.
8. Install into an isolated virtual environment and run the adapter as a dedicated unprivileged user.
9. Avoid presenting unaudited remote packages or images as interchangeable with the bundled source.

T09 · Insecure Skill Coding Practices

Warning

• Location: adapter.py:34

Finding

Unauthenticated Plaintext Clash API Control Channel

Content

View full analysis

Vulnerability Details

File Location: adapter.py:34, 349-357, 363-371, 428-441
Vulnerability Type: Unauthenticated security-sensitive API access over plaintext HTTP
Risk Level: Medium

Vulnerable Code

adapter.py:34:

python

CLASH_API = os.environ.get("CLASH_API", "http://clash:9090")

adapter.py:349-357:

python

async def get_proxy_list(self) -> List[str]:
    try:
        async with self.session.get(f"{self.clash_api}/proxies") as resp:
            data = await resp.json()
            proxies = data.get('proxies', {})
            return [name for name, info in proxies.items()
                    if info.get('type') in ['Shadowsocks', 'Vmess', 'Trojan', 'Hysteria']]
    except Exception as e:
        logger.error(f"Failed to obtain proxy list: {e}")
        return []

adapter.py:363-371:

python

async with self.session.get(
    f"{self.clash_api}/proxies/{node_name}/delay",
    params={'url': test_urls[0], 'timeout': 5000}
) as resp:
    if resp.status == 200:
        data = await resp.json()
        return data.get('delay', float('inf'))

adapter.py:428-441:

python

async def _switch_proxy(self, node_name: str):
    try:
        async with self.session.put(
            f"{self.clash_api}/proxies/Proxy",
            json={'name': node_name}
        ) as resp:
            if resp.status == 204:
                logger.info(f"Switched to node: {node_name}")
            else:
                logger.warning(f"Node switch failed: {resp.status}")
    except Exception as e:
        logger.error(f"Node switch failed: {e}")

The displayed log messages are English translations of the original messages; the executable API operations are unchanged.

Technical Analysis

The adapter communicates with the Clash controller using plaintext HTTP and does not send an authentication credential. It retrieves proxy topology, req ...[truncated 2039 chars]

Remediation

View remediation

Remediation Suggestions

1. Configure a strong Clash controller secret and send the required authenticated authorization header on every request.
2. Reject controller URLs that do not use an approved scheme and host.
3. Prefer a loopback-only controller, protected container network, or Unix-domain socket.
4. If remote controller access is required, use authenticated TLS and validate certificates against an explicit trust policy.
5. Do not permit arbitrary environment values to redirect the controller without configuration validation.
6. Validate response content, apply size limits, enforce JSON content types, and reject unexpected proxy names and types.
7. Restrict switching to a configured allowlist of trusted nodes and proxy groups.
8. Apply explicit connection, read, and total timeouts to every controller operation.
9. Configure network policy or firewall rules so only the adapter can reach the Clash controller.
10. Run the adapter and controller with least privilege and audit every routing change.

T09 · Insecure Skill Coding Practices

Note

• Location: start-adapter.sh:2

Finding

Detached Root-Scoped Process Lacks Safe Lifecycle and Single-Instance Controls

Content

View full analysis

Vulnerability Details

File Location: start-adapter.sh:2-3
Vulnerability Type: Unsafe background process management and excessive runtime privilege
Risk Level: Low

Vulnerable Code

start-adapter.sh:2-3:

bash

cd /root/.openclaw/searxng
nohup python3 -m adapter > /root/.openclaw/logs/searxng-adapter.log 2>&1 &

Technical Analysis

The launcher assumes deployment in root-owned paths and starts the adapter as a detached process with nohup. It does not drop privileges, enforce a single running instance, create a securely managed PID file, set resource limits, verify the module being imported, or provide a controlled shutdown mechanism.

Python module execution with python3 -m adapter resolves the module through Python's import path. The preceding fixed cd reduces accidental module substitution when that directory is properly protected, but compromise or unsafe permissions on the directory could still cause an unintended module to execute.

The script does not install a reboot-surviving startup service or scheduled task. Therefore, this finding is not classified as system persistence. The risk concerns unmanaged long-lived execution and root-context assumptions.

Attack Path

Duplicate-process path:

1. A user or automated deployment invokes start-adapter.sh more than once.
2. Each invocation starts another detached adapter because there is no lock or single-instance check.
3. All instances periodically query Clash and attempt to select or switch proxy nodes.
4. Competing decisions can cause unstable routing, additional outbound requests, excessive cache writes, and resource consumption.

Privilege-impact path:

1. The adapter is launched by root as suggested by its root-owned deployment paths.
2. An attacker compromises a runtime dependency or gains write access to the application directory.
3. The modified dependency or Python module executes when the launcher starts ...[truncated 623 chars]

Remediation

View remediation

Remediation Suggestions

1. Run the adapter under a dedicated unprivileged service account.
2. Replace nohup with a hardened service-manager unit that supports startup, shutdown, restart limits, logging, and health checks.
3. Enforce a single instance with the service manager or a securely created process lock.
4. Configure filesystem protections so the service account cannot modify application code or dependencies.
5. Use an absolute interpreter and script path instead of module discovery where practical.
6. Set a minimal working directory, environment, and executable search path.
7. Apply resource controls for memory, CPU, processes, and open files.
8. Restrict filesystem write access to the specific cache and log locations.
9. Provide documented start, stop, status, and restart operations.
10. Prevent repeated starts and fail safely if an existing instance is detected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (36)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · FINAL-TEST-REPORT-v3.0.md (reported line 421)May include surrounding context.

cat /root/.openclaw/searxng/proxy-cache.json | python3 -m json.tool

测试搜索

curl "http://localhost:8081/search?q=test&format=json" | python3 -m json.tool

text

### 故障恢复

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 92% confidence

Finding

The documented rm /root/.openclaw/searxng/proxy-cache.json deletes application state directly and could be repurposed or generalized unsafely in an agent/tooling context. Even if intended for recovery, destructive file operations without validation or warning can cause service instability, loss of diagnostic data, or accidental broader deletion when adapted poorly.

Content

Scanner excerpt · FINAL-TEST-REPORT-v3.0.md (reported line 432)May include surrounding context.

md

/root/.openclaw/searxng/start-adapter.sh

# 清理缓存
rm /root/.openclaw/searxng/proxy-cache.json

# 重启 SearXNG
docker restart searxng

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The documented behavior and detected capabilities indicate the skill may modify external proxy state through the Clash API, alter search-engine configuration, access local config/cache/log files, and make outbound requests, but these side effects are not clearly and accurately declared. Hidden or under-declared administrative actions are dangerous because users may install a 'monitoring/optimization' skill without realizing it can reconfigure live services and external networking behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The documented behavior and detected capabilities indicate the skill may modify external proxy state through the Clash API, alter search-engine configuration, access local config/cache/log files, and make outbound requests, but these side effects are not clearly and accurately declared. Hidden or under-declared administrative actions are dangerous because users may install a 'monitoring/optimization' skill without realizing it can reconfigure live services and external networking behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The runbook includes destructive or service-disruptive commands such as killing processes, deleting cache files, and restarting containers without warning about downtime, lost state, or recovery consequences. This increases the chance of unsafe operator behavior and can be abused in an agent context to justify harmful actions under the guise of maintenance.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The maintenance section documents process killing, cache deletion, and container restart commands that exceed passive search/proxy behavior and enable service-affecting administrative actions. In a skill artifact, these instructions can normalize or facilitate disruptive operations without guardrails, confirmation, rollback guidance, or least-privilege boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README advertises automatic proxy switching, 30-second connectivity probing, and automatic node optimization, but it does not clearly warn users that the skill will generate continuous outbound network traffic and may change system or service routing behavior. In this context, the omission is security-relevant because the skill interacts with a proxy control plane (Clash API) and could affect privacy, network policy compliance, detection by monitoring systems, or service availability if deployed without informed consent.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill advertises and demonstrates capabilities that access the network, local files, logs, configuration, and environment-like secrets, but it does not declare any explicit tool scope or permissions. This creates a transparency and least-privilege problem: users and hosting platforms cannot accurately constrain what the skill may access, increasing the chance of unintended file modification, secret exposure, or network egress.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation describes automatic engine switching, configuration changes, and SearXNG restarts, but does not prominently warn users that installing or enabling the skill can change live service behavior. In an operational environment, undocumented reconfiguration and restarts can cause outages, unexpected routing changes, or policy violations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly describes connectivity tests to external sites and sending alerts/reports, yet it does not clearly warn that operational telemetry and status data may leave the host and reach third-party services. This matters because network egress and data transmission can expose internal availability information, metadata, or secrets if logs and alerts are not carefully sanitized.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

Using a Docker image tagged as latest makes deployments non-reproducible and allows silent upstream changes to alter runtime behavior. If the upstream image is compromised or unexpectedly updated, users may pull and run malicious or unreviewed code without noticing.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Pulling pengong101/searxng-auto-proxy:latest creates the same supply-chain risk as any mutable image tag: the content may change after review and can introduce malicious code or breaking changes. This is especially relevant here because the container is documented as handling configuration, network checks, logs, and proxy control.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Enumerating all available proxy nodes and selecting among them gives the skill operational control beyond simple engine adaptation. In a shared environment, this capability can be abused or can unintentionally affect unrelated workloads by changing which upstream proxy is used globally.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The adapter does more than per-engine proxy adaptation: it actively reconfigures the external Clash proxy service by switching the global proxy group. That broadens the skill’s effective control surface from local search behavior to shared network routing, which can unexpectedly alter traffic handling for other applications and violates least-privilege expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code performs automatic proxy switching without any user confirmation or immediate user-facing warning at the point of action. This creates a silent state-changing behavior on external infrastructure, making configuration drift and unexpected network-path changes harder to detect and increasing the risk of misuse in automated environments.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · start-adapter.sh (reported line 3)May include surrounding context.

sh

#!/bin/bash
cd /root/.openclaw/searxng
nohup python3 -m adapter > /root/.openclaw/logs/searxng-adapter.log 2>&1 &
echo "适配器已启动，PID: $!"

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The document consistently forces a single language/locale for all instructions and operational guidance. Under the stated policy, a fixed language is only acceptable when users are given a choice or the locale restriction is clearly justified.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The report documents installation under /etc/systemd/system/ with a named service unit, indicating integration with system-level service management. Managing persistent OS services is not an obvious capability required by a skill whose manifest scope is adaptive proxy detection and search engine switching.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document title is presented in Chinese and the rest of the manifest content is likewise Chinese, but there is no indication that the skill is region-specific or that users may choose another language. This can violate language/locale policy when a skill defaults to a specific language without opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The natural-language instructions and operational guidance are presented only in Chinese, which effectively forces a specific language on users without opt-in. Under the stated policy, language constraints should either offer user choice or be clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Natural-language policy issues apply to all file types, including markdown. This file presents all substantive instructions and operational details only in Chinese, with no opt-in language choice or explanation that the skill is intended for a Chinese-language audience, which can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.