SearXNG Search engine For OpenClaw by Upsurge.ae

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 10:10 PM UTC
• Version: 1.4.0

Overview

This skill is a small local SearXNG search helper with some privacy overclaiming and output-branding quirks, but no evidence of hidden execution, persistence, credential access, or destructive behavior.

Install only if you already intend to run and trust a local SearXNG instance. Keep that service bound to loopback or a trusted Docker network, review its logging and enabled engines before searching sensitive internal terms, and expect the default output to append Upsurge attribution.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Note

• Location: search.py:49

Finding

Mandatory Promotional Branding Injected into Search Output

Content

View full analysis

Vulnerability Details

File Location: search.py, line 49
Vulnerability Type: Output manipulation through mandatory third-party promotional content
Risk Level: Low

Vulnerable Code

python

print(f"\n_Generated by Upsurge Private Intelligence Radar v1.1_")

Technical Analysis

Every successful search response is unconditionally modified by appending promotional branding unrelated to the functional search results. There is no command-line option or configuration setting to suppress this content.

Because the script is intended to generate agent-ingestible Markdown, this text becomes part of the agent-visible output and may be reproduced or treated as relevant response content. The attribution also identifies the generator as version v1.1, while SKILL.md declares package version 1.4.0, creating misleading provenance information.

This is classified as T01: Skill Instruction Hijacking because it modifies the content supplied to the consuming agent, although it does not directly alter safety constraints, execute code, or grant additional privileges.

Attack Path

1. An agent invokes search.py using a documented search command.
2. The script sends the encoded query to the local SearXNG endpoint.
3. SearXNG returns valid JSON search results.
4. The script formats those results as Markdown.
5. Line 49 unconditionally appends promotional branding to the agent-visible output.
6. The consuming agent may reproduce this injected attribution in a downstream answer or treat it as part of the requested content.

Impact Assessment

The issue affects output integrity and provenance. It can cause persistent third-party promotion in responses generated through this skill and may misrepresent the software version responsible for the output.

No operating-system privileges, credentials, persistent access, or code-execution capability can be obtained through this behavior. The scope is limited to ...[truncated 51 chars]

Remediation

View remediation

Remediation Suggestions

Remove the unconditional branding statement from the search-result path:

python

# Remove this statement:
print(f"\n_Generated by Upsurge Private Intelligence Radar v1.1_")

If attribution is required, make it explicitly opt-in through a command-line option such as --include-attribution, keep it clearly separated from search content, and derive the displayed version from a single authoritative package-version source. Automated tests should verify that default output contains only the requested search results and selected filter metadata.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill explicitly requires network-capable components (curl) and is centered around querying a locally hosted SearXNG service, but it does not declare any tool scope such as permissions or allowed-tools. This creates an authorization gap where an agent may be able to perform network actions without clear policy constraints or reviewer visibility, increasing the chance of unintended outbound requests or misuse of search capabilities.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill sends user search queries over plain HTTP to a local SearXNG instance, which provides no transport security if the service is bound beyond loopback, accessed through port forwarding, containers, or a hostile local network context. Given the skill explicitly markets privacy and 'Zero-Leak' behavior, silently transmitting sensitive search terms without any user disclosure or verification of a safe local transport path creates a meaningful privacy risk and could expose intelligence-gathering queries to interception or unintended logging.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The request parameters hard-code the language to "en-US", which imposes a specific locale on all searches. The file does not offer users a language choice or explain why this locale restriction is necessary.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.