free-local-web-search

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a coherent local SearXNG search skill, with noteworthy setup choices: it runs a persistent Docker container, uses an unpinned Docker image, and can be pointed at a non-local search endpoint.

This skill looks reasonable for local web search. Before installing, make sure you are comfortable running Docker, check that no important container named searxng-local already exists, keep SEARXNG_BASE_URL pointed to localhost or another trusted endpoint, and remove the container when you are done.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Running the installer can stop and delete any existing Docker container named searxng-local before starting the new service.

Why it was flagged

The installer intentionally removes and recreates a named Docker container. This is aligned with installing a local SearXNG service, but it mutates the user's Docker environment.

Skill content
run("docker rm -f searxng-local > /dev/null 2>&1 || true") ... "docker run -d --name searxng-local "
Recommendation

Before running install.py, check whether a searxng-local container already exists and rename or back it up if needed.

What this means

A future install may run a different version of the SearXNG image than the one originally reviewed.

Why it was flagged

The Docker image is referenced without a pinned tag or digest. This is central to the skill's purpose, but the exact container version may change over time.

Skill content
"--restart unless-stopped "
        "searxng/searxng"
Recommendation

Prefer pinning the Docker image to a specific trusted tag or digest when reproducibility matters.

What this means

If SEARXNG_BASE_URL is set to a remote or untrusted server, your search terms may be sent there.

Why it was flagged

Search queries go to the configured BASE_URL. The default is localhost, but an environment override can send queries to another SearXNG endpoint.

Skill content
BASE_URL = os.environ.get("SEARXNG_BASE_URL", DEFAULT_BASE).rstrip("/") ... r = requests.get(SEARCH_ENDPOINT, params=params, timeout=10)
Recommendation

Leave SEARXNG_BASE_URL unset for local-only use, or set it only to a trusted endpoint and document that configuration.

What this means

The local search service can keep running and consuming resources after the immediate task is complete.

Why it was flagged

The skill openly creates a background service that continues running after installation until stopped.

Skill content
Installation deploys a persistent Docker container (`searxng-local`) with `--restart unless-stopped`.
Recommendation

Remove it with docker rm -f searxng-local when you no longer need the service.