Ddg 1.0.0

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent ddgr/DuckDuckGo terminal-search helper, with only user-noticeable cautions around trusted installation sources and privacy expectations for web searches.

This skill appears safe for ordinary ddgr-based web searches. Before installing, use a trusted package source and be cautious with sudo/source-install commands. Treat search terms as information shared with web services, and avoid searching for secrets or sensitive private data.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

If the chosen package source or repository is not trusted, installation could modify the local system with elevated privileges.

Why it was flagged

The documented setup options include external package/source installation with elevated privileges. This is expected for installing ddgr, but users should verify the source before running these commands.

Skill content

sudo add-apt-repository ppa:twodopeshaggy/jarun ... git clone https://github.com/jarun/ddgr.git ... sudo make install

Recommendation

Prefer a trusted OS package or verified upstream release, and avoid running the source-install path unless you trust the repository and understand the sudo install step.

Info

#ASI02: Tool Misuse and Exploitation

What this means

Opening the first result automatically may visit an unexpected site, and disabling safe search changes filtering behavior.

Why it was flagged

The skill documents ddgr options that can open a search result directly or disable safe search. These are disclosed and user-directed, but should be used deliberately.

Skill content

Open first result in browser: `snap run ddgr "query" --ducky` ... `--unsafe` | Disable safe search

Recommendation

Review results before opening them when possible, and use `--ducky` or `--unsafe` only when the user specifically wants that behavior.

Info

#ASI09: Human-Agent Trust Exploitation

What this means

A user might over-trust the privacy wording and search for sensitive information that still leaves the local machine.

Why it was flagged

The privacy claims are broad for a web-search tool. The skill is purpose-aligned, but users should still understand that search terms are sent to DuckDuckGo and bang destinations may involve third-party sites.

Skill content

Privacy Features
- No user tracking or profiling
- Do Not Track enabled by default
- No stored search history

Recommendation

Do not include passwords, tokens, private documents, or other secrets in web search queries, even when using a privacy-focused search tool.