Searxng 1

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:37 PM UTC
• Version: 1.0.1

Overview

The skill does what it claims, but it routes potentially sensitive search queries through a configurable endpoint while disabling TLS verification by default and using broad automatic triggers.

Review before installing. This is not evidence of malware, but use it only with a SearXNG endpoint you control or trust, preferably localhost, and be aware that broad search-like prompts may trigger it. The publisher should change TLS verification to secure-by-default, require explicit opt-in for insecure self-signed use, narrow the triggers, and pin dependencies or provide a lock file.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/searxng.py:57

Finding

TLS Certificate Verification Disabled for All SearXNG Connections

Content

View full analysis

Vulnerability Details

File Location: scripts/searxng.py:57-63
Additional Location: scripts/searxng.py:20
Vulnerability Type: Improper certificate validation
Risk Level: High

Vulnerable Code

python

# Suppress SSL warnings for local self-signed certificates
warnings.filterwarnings('ignore', message='Unverified HTTPS request')

python

# Disable SSL verification for local self-signed certs
response = httpx.get(
    f"{SEARXNG_URL}/search",
    params=params,
    timeout=30,
    verify=False  # For local self-signed certs
)

Technical Analysis

The HTTP client explicitly sets verify=False, disabling TLS certificate-chain and hostname validation for every configured SearXNG endpoint. The behavior is not restricted to localhost or an explicitly approved self-signed certificate.

Consequently, possession of a valid certificate is not required to impersonate a remote HTTPS SearXNG service. The warning filter also suppresses indications that an unverified HTTPS connection is being used. HTTPS encryption without certificate authentication does not protect against an active man-in-the-middle attacker.

Attack Path

1. A user configures SEARXNG_URL with an HTTPS endpoint.
2. An attacker gains a position capable of manipulating traffic, such as a hostile wireless network, compromised DNS resolver, proxy, or gateway.
3. The attacker redirects the connection to an impersonated SearXNG service presenting an invalid or attacker-controlled certificate.
4. Because verify=False is used, the client accepts the certificate without validating its trust chain or hostname.
5. The attacker observes submitted search queries and returns manipulated search results, URLs, titles, or snippets.
6. A user or downstream agent may act on the attacker-controlled results.

Impact Assessment

The attacker can compromise the confidentiality and integrity of data exchanged with the ...[truncated 391 chars]

Remediation

View remediation

Remediation Suggestions

• Remove verify=False and use certificate verification by default:

  python

  response = httpx.get(
      f"{SEARXNG_URL}/search",
      params=params,
      timeout=30,
      verify=True,
  )
  

• Support private certificate authorities through an explicit CA bundle path, such as SEARXNG_CA_BUNDLE, and pass that trusted bundle to httpx.

• If insecure TLS support is unavoidable, require an explicitly named opt-in setting such as SEARXNG_INSECURE_TLS=true; never enable it by default.

• Emit a prominent warning whenever insecure mode is enabled rather than suppressing TLS warnings.

• Consider restricting insecure mode to loopback addresses and reject its use with non-local hosts.

• Add automated tests confirming that invalid certificates and hostname mismatches are rejected by default.

T08 · Insecure Dependencies

Warning

• Location: scripts/searxng.py:2

Finding

Unpinned Dependencies Are Automatically Resolved at Runtime

Content

View full analysis

Vulnerability Details

File Location: scripts/searxng.py:2-5
Supporting Location: SKILL.md:23-38
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

python

# /// script
# requires-python = ">=3.11"
# dependencies = ["httpx", "rich"]
# ///

The documented execution method automatically invokes dependency resolution:

bash

uv run {baseDir}/scripts/searxng.py search "query"
uv run {baseDir}/scripts/searxng.py search "query" -n 20
uv run {baseDir}/scripts/searxng.py search "query" --format json

Technical Analysis

The inline PEP 723 metadata declares httpx and rich without version constraints. No reviewed lock file or package hashes are present in the audited project. Running the script through uv run may therefore resolve and install whichever package releases satisfy the unrestricted dependency declarations at execution time.

This creates a mutable supply-chain boundary: the dependency code ultimately executed can differ from the dependency versions reviewed or tested by the project author. The audit found no evidence that either named package is currently malicious; the risk arises from unrestricted future resolution, package-source compromise, or an incompatible future release.

Attack Path

1. An attacker compromises a dependency publisher account, package repository, configured package index, or network path to an insufficiently protected private mirror.
2. The attacker publishes or serves a malicious release under one of the declared dependency names.
3. A user invokes the documented uv run command in an environment that does not already have a safely locked resolution.
4. The resolver selects and installs the malicious release because no reviewed version or hash is required.
5. Package installation or import executes attacker-controlled Python code in the context of the user running the skill.

Impact As

...[truncated 567 chars]

Remediation

View remediation

Remediation Suggestions

• Pin dependencies to reviewed versions rather than allowing unrestricted resolution, for example:

  python

  # dependencies = [
  #   "httpx==<reviewed-version>",
  #   "rich==<reviewed-version>",
  # ]
  

• Generate and commit a lock file when supported by the deployment workflow.

• Use hash-verified artifacts so that installation fails if package contents differ from the reviewed artifacts.

• Configure dependency resolution to use a trusted package index and authenticated internal mirrors where applicable.

• Add automated dependency vulnerability and integrity scanning.

• Establish a controlled update process that reviews, tests, and deliberately updates pinned versions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (14)

Tainted flow: 'SEARXNG_URL' from os.getenv (line 23, credential/environment) → httpx.get (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/searxng.py (reported line 61)May include surrounding context.

python

try:
        # Disable SSL verification for local self-signed certs
        response = httpx.get(
            f"{SEARXNG_URL}/search",
            params=params,
            timeout=30,

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · PUBLISHING_CHECKLIST.md (reported line 78)May include surrounding context.

md

1. **Review all files** - Make sure everything is polished
2. **Test one more time** - Fresh installation test
3. **Version bump if needed** - Update SKILL.md, metadata.json, CHANGELOG.md
4. **Git commit** - Clean commit message
5. **Submit to ClawdHub** - Follow ClawdHub submission process
6. **Monitor feedback** - Be ready to address issues

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 89% confidence

Finding

The troubleshooting command uses curl -k, which disables TLS certificate validation and trains users to ignore HTTPS authenticity checks. While presented for convenience with local/self-signed instances, this makes man-in-the-middle attacks easier if the URL points to a remote host or if local network traffic can be intercepted.

Content

Scanner excerpt · README.md (reported line 138)May include surrounding context.

1. Check your SearXNG instance is running:

   bash

   curl -k $SEARXNG_URL
   # Or: curl -k http://localhost:8080 (default)
   

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · PUBLISH.md (reported line 117)May include surrounding context.

md

If you make changes later:

1. Update version in SKILL.md and metadata.json
2. Add entry to CHANGELOG.md
3. Run: `clawdhub publish skills/searxng`

### Manage Your Skill

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file instructs users to run clawdhub delete searxng, which can affect availability of the published skill, but it does not include any warning or caution about the consequences of deleting a skill. Under the markdown-specific warning criterion, destructive behavior that could affect user data or system integrity should be disclosed explicitly.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README instructs users to run the searxng/searxng Docker image without a pinned tag or digest, which creates a supply-chain risk because future pulls may fetch a different or compromised image than expected. In a setup guide, this is a real security weakness because it encourages non-reproducible and potentially unsafe deployments.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

The README states the skill is configured with verify=False, meaning TLS certificate validation is disabled by default in HTTP requests. This is a genuine security issue because it permits silent interception or spoofing of the SearXNG endpoint, especially dangerous if the instance is remote, accessed over untrusted networks, or carries sensitive search queries.

Content

Scanner excerpt · README.md (reported line 128)May include surrounding context.

md

## SSL/TLS Notes

The skill is configured to work with self-signed certificates (common for local SearXNG instances). If you need strict SSL verification, edit the script and change `verify=False` to `verify=True` in the httpx request.

## Troubleshooting

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill invokes a Python script and depends on environment variables and network access, but it does not declare any explicit tool scope or permissions. This creates a transparency and policy-enforcement gap: a host may allow the skill to run without users realizing it can make outbound requests and read configuration from the environment.

Content

No source excerpt is available for this finding.

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 90% confidence

Finding

The trigger 'search for' overlaps with a built-in 'search' command, creating a shadowing risk where this skill may be selected instead of the expected native behavior. In this context, that means ordinary search requests could be rerouted to a local or configured SearXNG endpoint, changing trust boundaries and causing unintended outbound traffic.

Content

No source excerpt is available for this finding.

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 90% confidence

Finding

The trigger 'search web' conflicts with the built-in 'search' behavior and may shadow default command routing. This can unexpectedly divert user requests through this skill's networked backend, which is especially relevant because the destination is configurable via SEARXNG_URL.

Content

No source excerpt is available for this finding.

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 86% confidence

Finding

The trigger 'find information' is broad and conflicts with built-in 'find' semantics, increasing the chance of accidental skill activation. In a network-enabled skill, accidental activation can leak user queries to the configured search instance and produce results from an unintended source.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The triggers are generic conversational phrases such as 'search for', 'search web', 'find information', and 'look up', which are likely to appear in ordinary user requests. Overly broad triggers can cause unintended invocation of this skill, leading to unplanned network requests and possible interception of requests meant for safer or built-in functionality.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

TLS certificate verification is explicitly disabled with verify=False, which permits man-in-the-middle interception or tampering with search requests and responses whenever HTTPS is used. In a search tool, this can expose sensitive queries, allow result manipulation, and undermine any privacy guarantees, especially if SEARXNG_URL is not actually limited to localhost.

Content

Scanner excerpt · scripts/searxng.py (reported line 65)May include surrounding context.

python

f"{SEARXNG_URL}/search",
            params=params,
            timeout=30,
            verify=False  # For local self-signed certs
        )
        response.raise_for_status()

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This code sends the user-provided search query to the configured SearXNG instance over HTTP(S), which is a network operation that transmits user data. While the script's purpose is search, the CLI help and runtime output do not explicitly warn users that their query will be sent to the configured instance, including any non-local URL set via SEARXNG_URL.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.