v0.1.2

Searxng Search

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 5:18 AM.

Analysis

This appears to be a straightforward SearXNG search connector, with the main considerations being trusted endpoint use and user-directed setup steps.

GuidanceThis skill is reasonable for web search if you trust the configured SearXNG server. Before installing, confirm the endpoint, avoid sending sensitive queries, install mcporter only from a trusted source, and back up or merge any existing mcporter configuration instead of blindly overwriting it.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agentic Supply Chain Vulnerabilities

SeverityLowConfidenceHighStatusNote

SKILL.md

cp config.json ~/.config/mcporter/config.json
...
npm install -g mcporter

The documented setup uses a global npm-installed dependency and copies a config file into the user's mcporter configuration. This is user-directed and purpose-aligned, but users should be aware of the dependency and config-file impact.

User impactInstalling mcporter globally affects the local environment, and copying config.json may overwrite or replace an existing mcporter configuration.

RecommendationVerify the mcporter package source, install it intentionally, and merge or back up any existing mcporter config before copying this file.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityLowConfidenceHighStatusNote

mcp-server.py

url = f"{SEARXNG_URL}/search?q={encoded_query}&format=json"
with urllib.request.urlopen(url, timeout=30) as response:

The MCP server sends the user's search query to the configured SearXNG endpoint. This is purpose-aligned, but the endpoint receives the search terms.

User impactSearch queries, including any sensitive text placed in them, will be sent to the configured SearXNG server.

RecommendationUse a SearXNG instance you trust, avoid searching for secrets or private data, and prefer HTTPS for remote instances.

Memory and Context Poisoning

SeverityLowConfidenceHighStatusNote

mcp-server.py

f"   {r.get('content', 'N/A')[:200]}...\n"
...
"text": f"Search results for '{query}':\n\n" + "\n\n".join(formatted_results)

The tool returns web result snippets as text to the agent. Web results are untrusted retrieved context and may contain misleading or instruction-like content.

User impactA malicious or low-quality search result could try to influence the agent if the agent treats result text as authoritative.

RecommendationTreat search results as untrusted references and verify important claims or instructions before acting on them.