SearXNG Self-Host

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:15 PM UTC
• Version: 1.0.1

Overview

The skill is coherent for self-hosted search, but its installer uses root privileges to fetch mutable third-party code and enable a persistent service, so it needs Review before use.

Install only on a machine where you are comfortable granting root-level setup authority and running a persistent local search service. Review or modify the installer to pin and verify SearXNG, uv, and dependencies before production use, and avoid sending sensitive prompts or internal identifiers as searches because fallback mode sends queries to Wikipedia and GitHub.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: scripts/install_searxng.sh:14

Finding

Unpinned Third-Party Code and Dependency Installation with Root Privileges

Content

View full analysis

/dev/null; then pip3 install -q uv --break-system-packages fi echo "[2/6] Creating searxng user and directories..." id -u $SEARXNG_USER &>/dev/null || /usr/sbin/useradd -r -d $SEARXNG_HOME -s /bin/false $SEARXNG_USER mkdir -p $SEARXNG_HOME chown $SEARXNG_USER:$SEARXNG_USER $SEARXNG_HOME echo "[3/6] Cloning SearXNG..." if [ -d "$SEARXNG_HOME/searxng-src" ]; then echo " Already cloned — skipping" else git clone https://github.com/searxng/searxng "$SEARXNG_HOME/searxng-src" --depth=1 fi echo "[4/6] Installing dependencies with uv..." cd "$SEARXNG_HOME/searxng-src" uv venv "$SEARXNG_HOME/searx-venv" --python python3 uv pip install --python "$SEARXNG_HOME/searx-venv/bin/python" \ -r "$SEARXNG_HOME/searxng-src/requirements.txt" ``` ### Technical Analysis The installer is documented to run as root, but it downloads and installs mutable third-party components without pinning or integrity verification: - `pip3 install uv` resolves the latest available version rather than a reviewed version. - `--break-system-packages` modifies the operating system’s managed Python environment, increasing the potential scope of dependency conflicts or compromise. - `git clone` retrieves the current default branch of SearXNG without selecting a reviewed commit, immutable release tag, or signed release. - Dependencies are installed from the newly downloaded `requirements.txt` without a locally reviewed lock file or enforced hashes. - No checksum, signature, commit allowlist, or provenance verification is performed. Consequently, the code executed or installed by this script can change after the Skill its ...[truncated 1945 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

Verify:

bash

curl 'http://127.0.0.1:8888/search?q=test&format=json' | python3 -m json.tool | head -20
systemctl status searxng

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · references/usage.md (reported line 39)May include surrounding context.

Verify:

bash

curl 'http://127.0.0.1:8888/search?q=test&format=json' | python3 -m json.tool | head -20
systemctl status searxng

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill instructs users to perform network and shell actions, including installation and service management, but does not declare any tool scope such as permissions or allowed-tools. In an agent setting, this creates an authorization gap where powerful capabilities may be invoked without explicit restriction or review, increasing the chance of unintended command execution or network access.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

The skill explicitly tells the operator to run installation as root, which is a privileged execution path. While software installation often requires elevated privileges, embedding root-level execution in a broadly reusable agent skill increases risk if the referenced script is modified, misused, or triggered in the wrong environment, since any mistake would have full system impact.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

Installation (new instance)

Run as root on Ubuntu 22.04/24.04:

bash

bash scripts/install_searxng.sh

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/install_searxng.sh (reported line 95)May include surrounding context.

sh

EOF

systemctl daemon-reload
systemctl enable searxng
systemctl restart searxng

echo ""

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script silently falls back from a local SearXNG instance to direct requests to Wikipedia and GitHub, which transmits user queries to external third parties. In an agent context, queries may contain sensitive prompts, internal identifiers, or operational data, so this behavior can violate expected data-boundary assumptions even though it is framed as resilience logic.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The GitHub API request sends search queries to an external service, creating a direct outbound data flow. In this skill's context, the danger is elevated because users may expect a self-hosted/local search path, while agent-generated queries can include sensitive internal terms that should not be disclosed to third parties.

Content

Scanner excerpt · scripts/search.py (reported line 52)May include surrounding context.

python

def search_github(query, count=5):
    """GitHub Search API - 10 req/min unauthenticated"""
    url = f"https://api.github.com/search/repositories?q={urllib.parse.quote(query)}&per_page={count}"
    req = urllib.request.Request(url, headers={**HEADERS, 'Accept': 'application/vnd.github.v3+json'})
    try:
        with urllib.request.urlopen(req, timeout=8) as r:

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The top-level docstring presents 'Primary' and 'Fallback' backends as if they are part of the general search behavior, but the implementation only invokes the direct APIs conditionally after a SearXNG failure. This is a documentation-to-code mismatch about operational behavior, not just missing detail.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.