Ddg 1.0.0

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:15 PM UTC
• Version: 1.0.0

Overview

This skill is a coherent ddgr search helper, but its install instructions include root-level installation from unpinned third-party sources without verification guidance.

Review the install path before using this skill. Prefer a trusted OS package or verified release, avoid running sudo make install from an unpinned clone, and be aware that --ducky or interactive result selection can open third-party pages in your browser.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17
• Finding: Unpinned Third-Party Dependencies Installed with Elevated Privileges<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 17-29 **Vulnerability Type**: Unverified and mutable third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash ### Via PPA: ```bash sudo add-apt-repository ppa:twodopeshaggy/jarun sudo apt-get update sudo apt-get install ddgr ``` ### From source: ```bash git clone https://github.com/jarun/ddgr.git cd ddgr sudo make install ``` ``` ### Technical Analysis The documented installation procedures introduce third-party software through a PPA and an unpinned Git repository. The source installation clones the repository's mutable default branch without specifying a reviewed release tag or commit and without verifying a cryptographic signature or checksum. It subsequently executes the project's installation procedure through `sudo make install`. The PPA procedure similarly establishes trust in a third-party package repository and installs its package with root privileges. Although these commands are consistent with installing the advertised utility, they provide no documented mechanism for verifying that the retrieved package or source corresponds to an audited release. An attacker who compromises the upstream repository, maintainer account, release infrastructure, PPA, or associated signing environment could replace the expected dependency or installation logic. A user following the documented instructions could then execute attacker-controlled installation behavior with elevated privileges. ### Attack Path 1. An attacker compromises the upstream Git repository, its maintainer account, the third-party PPA, or the relevant distribution infrastructure. 2. The attacker modifies the default branch, build scripts, installation target, or published package to include malicious behavior. 3. A user follows the Skill's installation instructions. 4. The system retrieves the mutable or compromised content without validating a pinned revision against an independently trus ...[truncated 906 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prefer a package from a trusted operating-system repository where available. 2. Pin source installations to a specific reviewed release tag and full commit hash rather than cloning the mutable default branch. 3. Verify downloaded releases using a checksum or cryptographic signature obtained through an independently trusted channel. 4. Document the expected release version, commit identifier, signer identity, and verification commands. 5. Build the software as an unprivileged user in an isolated environment. 6. Review the build and installation scripts before execution. 7. Avoid running the complete build process with `sudo`; elevate privileges only for the minimal, verified file-copy step. 8. If the PPA remains an option, document its trust implications, pin an expected package version, and verify repository signing-key fingerprints through an independent source. 9. Consider using a sandbox, container, or package-building environment to constrain installation-time behavior. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (9)

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

### Via Snap (recommended for Ubuntu):
```bash
sudo snap install ddgr
```

### Via PPA:

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

### Via Snap (recommended for Ubuntu):
```bash
sudo snap install ddgr
```

### Via PPA:

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

### Via Snap (recommended for Ubuntu):
```bash
sudo snap install ddgr
```

### Via PPA:

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

### Via Snap (recommended for Ubuntu):
```bash
sudo snap install ddgr
```

### Via PPA:

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
git clone https://github.com/jarun/ddgr.git
cd ddgr
sudo make install
```

**Dependencies:** Python 3.8 or later

• Confidence: 76% confidence
• Finding: `sudo make install` after cloning from source executes installation steps as root from a freshly downloaded codebase. If the repository or build scripts are compromised, this can lead to arbitrary code execution with full system privileges, making it materially riskier than normal packaged installation guidance.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

## Troubleshooting

**Command not found:**
- Ensure ddgr is installed via snap: `sudo snap install ddgr`
- Use full command: `snap run ddgr` instead of just `ddgr`

**No results:**

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The skill documentation includes `--ducky` to open the first result in a browser, which affects the user's system state and launches external content. The surrounding description presents this as a normal usage example but does not include any warning or caution about opening a browser or navigating to third-party sites.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The interactive commands state that entering result numbers opens the selected result in a browser, but the markdown does not warn that this launches external sites outside the terminal. For a skill description, this is a user-impacting behavior that should be disclosed where the action is introduced.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The document explicitly demonstrates use of `ddgr --unsafe` but provides no warning that this disables safe-search filtering and may return adult, offensive, or otherwise inappropriate content. In a command-line search skill, users may copy examples directly, so documenting the unsafe mode without context increases the chance of unintended exposure to unfiltered results.

Static analysis

No suspicious patterns detected.