Augmented Search

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:20 AM UTC
• Version: 1.1.3

Overview

The skill is a coherent search tool, but its install and deployment instructions use mutable third-party code and expose local services more broadly than users may expect.

Install only if you are comfortable running this as a local search service. Prefer pinned package versions and image digests, avoid curl | sh, bind ports to 127.0.0.1 or a private network, add authentication before any remote access, and treat search queries, fetched URLs, and optional embedding content as data that may be sent to configured upstream providers.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: reference/installation.md:194

Finding

Unverified Remote Installer Is Piped Directly into a Shell

Content

View full analysis

Vulnerability Details

File Location: reference/installation.md:194
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: High

Vulnerable Code:

bash

curl -fsSL https://ollama.com/install.sh | sh

Technical Analysis

The installation guide retrieves a mutable shell script from an external URL and immediately passes the response to sh. The command provides no opportunity to inspect the downloaded script and does not verify a version, checksum, cryptographic signature, or publisher provenance.

The effective code executed by this instruction can change after the Skill has been reviewed. Compromise of the remote hosting infrastructure, publisher account, DNS resolution, certificate trust path, or installer distribution process could therefore turn this command into an arbitrary-code-execution channel.

Installing Ollama is only an optional method of enabling embedding-based reranking. It is not required for the Skill's core SearXNG search functionality. Consequently, immediate execution of an unverified remote installer exceeds the minimum behavior needed for the declared functionality.

Attack Path

1. An attacker compromises the remote installer, its hosting infrastructure, or another relevant part of the distribution chain.
2. The attacker modifies the response returned by https://ollama.com/install.sh.
3. A user follows the Skill's optional Ollama installation instructions.
4. curl retrieves the attacker-controlled response.
5. The shell pipe executes the response immediately without integrity verification or review.
6. The payload runs with the privileges of the invoking user and may attempt privilege elevation if the installation process invokes sudo or prompts for administrative access.

Impact Assessment

Successful exploitation permits arbitrary command execution under the account running the command. The payload could read or modify files ava ...[truncated 287 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the direct curl | sh instruction.
• Prefer a link to the vendor's official platform-specific installation documentation.
• If an automated installation must be documented, use a two-stage process:
  1. Download a version-pinned release artifact to a local file.
  2. Verify its publisher signature or a checksum obtained through a trusted channel.
  3. Inspect the downloaded content.
  4. Execute it explicitly only after verification.
• Avoid instructing users to run the installer as root unless a documented installation step strictly requires elevation.
• Clearly state that Ollama and embedding-based reranking are optional and are not required for the core search service.
• Pin the expected installer or package version and document how users can verify publisher provenance.

T08 · Insecure Dependencies

Error

• Location: reference/installation.md:35

Finding

Mutable and Unpinned Packages and Container Images Are Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:31-42; reference/installation.md:35-47,85,249-252
Vulnerability Type: Unpinned executable third-party dependencies
Risk Level: High

Vulnerable Code:

From SKILL.md:

bash

docker run -d --name searxng -p 8080:8080 searxng/searxng:latest
docker run -d --name augmented-search -p 3000:3000 \
  -e SEARXNG_URL=http://host.docker.internal:8080 \
  ghcr.io/sebrinass/mcp-augmented-search:latest

bash

npm install -g augmented-search
SEARXNG_URL=http://localhost:8080 augmented-search

From reference/installation.md:

yaml

services:
  searxng:
    image: searxng/searxng:latest
    container_name: searxng
    ports:
      - "8080:8080"
    volumes:
      - ./searxng:/etc/searxng:rw
    environment:
      - SEARXNG_BASE_URL=http://localhost:8080/
    restart: unless-stopped

  augmented-search:
    image: ghcr.io/sebrinass/mcp-augmented-search:latest
    container_name: augmented-search
    ports:
      - "3000:3000"

bash

npm install -g augmented-search

bash

# Use npx
mcporter call --stdio "npx augmented-search" search ...

# Use Docker
mcporter call --stdio "docker run -i --rm -e SEARXNG_URL ghcr.io/sebrinass/mcp-augmented-search:latest" search ...

Technical Analysis

The installation instructions use the mutable latest tag for both container images and install the npm package without a fixed version. The npx augmented-search example can resolve, download, and execute a package dynamically when it is not already available locally.

Mutable tags and unconstrained package resolution prevent a user from reliably obtaining the same artifacts that were previously reviewed. A legitimate upstream update, registry compromise, publisher-account compromise, or package takeover could cause materially different code to be installed and executed without any documentation change.

...[truncated 1707 chars]

Remediation

View remediation

Remediation Suggestions

• Pin npm installation instructions to a reviewed version, such as augmented-search@1.1.2, and document the expected package integrity value.
• Use a lockfile with integrity metadata for reproducible local installations.
• Avoid dynamic execution through an unconstrained npx command. Install and verify the package first, then use npx --no-install or invoke the verified local binary directly.
• Pin container images by immutable digest, for example image@sha256:..., rather than using :latest.
• Publish signed release artifacts, image signatures, checksums, software bills of materials, and verifiable build provenance.
• Document signature verification with an appropriate mechanism, such as Sigstore/Cosign for container images.
• Use read-only mounts wherever write access is unnecessary and run containers as non-root users with dropped Linux capabilities.
• Establish an explicit dependency-update and security-review process before changing pinned versions or digests.

T09 · Insecure Skill Coding Practices

Warning

• Location: reference/installation.md:35

Finding

Services Are Exposed on All Host Interfaces Without Documented Authentication or Rate Limiting

Content

View full analysis

Vulnerability Details

File Location: reference/installation.md:35-47,125-129
Vulnerability Type: Excessive network exposure and unsafe service configuration
Risk Level: Medium

Vulnerable Code:

yaml

services:
  searxng:
    image: searxng/searxng:latest
    container_name: searxng
    ports:
      - "8080:8080"
    volumes:
      - ./searxng:/etc/searxng:rw
    environment:
      - SEARXNG_BASE_URL=http://localhost:8080/
    restart: unless-stopped

  augmented-search:
    image: ghcr.io/sebrinass/mcp-augmented-search:latest
    container_name: augmented-search
    ports:
      - "3000:3000"

yaml

server:
  port: 8080
  bind_address: "0.0.0.0"
  secret_key: "Change to a random string"  # Must be changed!
  limiter: false
  image_proxy: false

Technical Analysis

Docker port mappings written as "8080:8080" and "3000:3000" ordinarily publish the ports on all available host interfaces unless the Docker daemon is otherwise restricted. The SearXNG configuration additionally binds to 0.0.0.0 and explicitly disables its limiter.

The reviewed instructions do not configure authentication for the MCP/REST endpoint or restrict access to a trusted network. This is broader than necessary for the documented local OpenClaw integration, which can operate through loopback access or an internal Docker network.

The service advertises search, URL-reading, and documentation-query capabilities. Exposing these operations to untrusted network clients can permit unauthorized use and resource consumption. The audit cannot confirm additional server-side vulnerabilities because no implementation source code is present.

Attack Path

1. A user starts the documented Compose deployment on a host reachable by other network participants.
2. Docker publishes ports 8080 and 3000 on the host's available interfaces.
3. An attacker discovers either port through local-networ ...[truncated 1247 chars]

Remediation

View remediation

Remediation Suggestions

• Bind host-published ports to loopback for local-only use:

  yaml

  ports:
    - "127.0.0.1:3000:3000"
  

• Do not publish the SearXNG port to the host when only the augmented-search container requires it; keep communication on a private Docker network.
• Enable authentication for MCP and REST access before allowing remote connections.
• Enable rate limiting and set conservative request, concurrency, response-size, and timeout limits.
• Restrict ingress using host firewalls, Docker network policy, reverse-proxy access controls, or VPN-based access.
• Use TLS when traffic crosses a trusted host boundary.
• Run both containers as non-root users, drop unnecessary capabilities, and use read-only filesystems and mounts where possible.
• Add explicit warnings that the documented configuration is intended for local development and must not be exposed directly to untrusted networks.
• Log and monitor failed authentication, unusual request volume, expensive URL-reading operations, and upstream quota consumption.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The guide recommends piping a remotely fetched install script directly into sh. This is a classic command-execution anti-pattern that allows arbitrary code execution if the source is compromised, intercepted, or unexpectedly changed, and it is especially risky in installation docs because users are likely to run it verbatim.

Content

Scanner excerpt · reference/installation.md (reported line 194)May include surrounding context.

bash

# 安装 Ollama
curl -fsSL https://ollama.com/install.sh | sh

# 拉取嵌入模型
ollama pull nomic-embed-text

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill exposes a read tool that fetches arbitrary URLs, but the documentation does not warn users that submitted targets and access metadata may be transmitted to external sites. In a search/fetching skill, this omission matters because agents may unknowingly request internal, sensitive, or user-specific URLs, creating privacy leakage and possible SSRF-style misuse depending on backend protections.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.

bash

# 健康检查
curl http://localhost:3000/health

# 搜索
curl -X POST http://localhost:3000/api/search \

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

L156 在必要配置示例中将 default_lang 设为 zh-CN，属于自然语言/区域设置的强制默认。文档未说明用户可根据自身偏好修改，也未将其限定为特定地区部署场景，因而构成语言/locale 政策风险。

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · reference/installation.md (reported line 208)May include surrounding context.

bash

export EMBEDDING_API_KEY="sk-..."
export EMBEDDING_BASE_URL="https://api.openai.com/v1"
export EMBEDDING_MODEL="text-embedding-3-small"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · reference/installation.md (reported line 216)May include surrounding context.

bash

export EMBEDDING_API_KEY="jina_..."
export EMBEDDING_BASE_URL="https://api.jina.ai/v1"
export EMBEDDING_MODEL="jina-embeddings-v2-base-en"

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

The documentation instructs users to invoke mcporter via npx without pinning a specific version. This causes execution of whatever package version is current at install time, creating a supply-chain risk if a malicious or compromised release is published.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The example runs augmented-search through npx without a pinned version, which means users may execute an unexpected future release or a compromised package from the registry. In an MCP/server context this is more sensitive because the executed tool may process prompts, code, and local data.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 83% confidence

Finding

The Docker example pulls and runs the container image using the latest tag rather than a fixed tag or digest. This makes deployments non-reproducible and exposes users to supply-chain compromise if the upstream image is replaced or a bad release is pushed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Natural-language policy violations include forcing a specific language without user opt-in. This skill's manifest descriptions and documentation are presented in Chinese, but there is no indication that the user can choose another language or that the language restriction is deliberate and justified.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 15% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · reference/installation.md (reported line 78)May include surrounding context.

步骤 4：验证

bash

curl http://localhost:8080/search?q=test
curl http://localhost:3000/health

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 15% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · reference/installation.md (reported line 78)May include surrounding context.

步骤 4:验证

bash

curl http://localhost:8080/search?q=test
curl http://localhost:3000/health

Static analysis

No suspicious patterns detected.