SearXNG Search engine For OpenClaw by Upsurge.ae

• Outcome: Pass
• Latest audit: May 28, 2026 at 6:16 AM UTC
• Version:
  1.4.0

Overview

This skill is a small local SearXNG search wrapper with no evidence of persistence, credential theft, destructive behavior, or hidden exfiltration.

Install this only if you intend to use a local SearXNG instance. For sensitive searches, verify which SearXNG engines are enabled and whether that instance logs or forwards queries to third-party search providers.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises and depends on network-capable behavior (`curl`, a local SearXNG HTTP endpoint, and search operations) but does not declare corresponding permissions. This creates a transparency and policy-enforcement gap: operators may approve the skill believing it has no sensitive capabilities, while it can still send queries over the network and potentially expose sensitive search terms or reach unintended endpoints if the implementation changes.

VirusTotal

66/66 vendors flagged this skill as clean.