Local web search using SearXNG
v1.0.0Search the web using a self-hosted SearXNG metasearch engine. Aggregates Google, Brave, DuckDuckGo, and more without API keys.
⭐ 1· 3.2k·12 current·13 all-time
by@stperic
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's stated purpose (use a self-hosted SearXNG instance) matches the actual code: the Python script queries a provided SEARXNG_URL and returns JSON results. However, the registry metadata in the package summary claimed no required environment variables or binaries, while SKILL.md metadata and the script require python3 and the SEARXNG_URL environment variable. That metadata mismatch is unexpected and reduces confidence in packaging/maintenance.
Instruction Scope
SKILL.md instructions are narrowly scoped: they tell the agent/user to set SEARXNG_URL and run the provided Python script. The script only performs HTTP requests to the SEARXNG_URL and does not read other files, credentials, or system state. Minor inconsistency: quick-start examples reference a scripts/ path (~/.clawdbot/skills/searxng/scripts/searxng_search.py) while the manifest shows searxng_search.py at top level.
Install Mechanism
There is no install spec (instruction-only / bundled script). Nothing is downloaded or extracted at install time, which reduces install-time risk.
Credentials
The script expects a single environment variable, SEARXNG_URL, which is appropriate for its purpose. The concern is the registry metadata omission: the skill package does not declare this required env/binary in the registry summary, so automated install flows or permission prompts might not surface the need for this sensitive endpoint URL.
Persistence & Privilege
The skill does not request persistent privileges, does not set always:true, and does not modify other skills or system configuration. It runs only when invoked and performs network requests to the configured SearXNG instance.
What to consider before installing
This skill appears to be a simple, honest client for a self-hosted SearXNG instance and the Python code looks benign (it only calls the URL you provide). Before installing: 1) Verify and correct the metadata mismatch — the registry should declare python3 and SEARXNG_URL so prompts/permissions are clear. 2) Confirm which file path will be executed (manifest vs quick-start path). 3) Only set SEARXNG_URL to a trusted endpoint (prefer HTTPS) — the skill will send your queries to that URL and the instance will see them. 4) If you plan to let the agent call this autonomously, consider network controls or allowlisting the SearXNG host to reduce risk. If you want higher assurance, run the script locally yourself first or inspect and run it in an isolated environment.Like a lobster shell, security has layers — review code before you run it.
latestvk9738thhqmt994x1x5ra8w2va5803pjj
License
MIT-0
Free to use, modify, and redistribute. No attribution required.