Web Search Plus Plugin
Security checks across malware telemetry and agentic risk
Overview
The plugin's code, docs, and runtime instructions are consistent with a multi-provider web-search tool; nothing in the package requests unrelated secrets or installs arbitrary external code, but the documented SearXNG private-IP override is a security-sensitive option you should only enable on trusted networks.
This plugin appears to be what it claims: a multi-provider web-search tool that uses only Node builtins and stores cache in a plugin-local .cache/ directory. Before installing: 1) Only provide API keys for providers you trust; keys belong in the plugin config or a plugin-local .env (do not commit .env to version control). 2) Be cautious with SEARXNG_ALLOW_PRIVATE — enabling it disables SSRF protections and can allow the plugin to contact internal/private IPs via a SearXNG instance; enable that flag only if you control the network and trust the SearXNG instance. 3) Verify the plugin source (GitHub repo) and review any updates; note a minor doc mismatch: some READMEs mention Linkup/Firecrawl while an earlier SKILL.md snippet omitted them — the code does include those providers. 4) If you need higher assurance, run the plugin in a sandboxed environment or review the full index.ts for provider adapters and network targets. Overall, behavior is coherent and proportional to the stated purpose.
SkillSpector
SkillSpector findings are pending for this release.
VirusTotal
VirusTotal engine telemetry is currently malicious for this artifact.