Searxng Search

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:07 AM UTC
• Version: 0.1.2

Overview

The skill is a coherent SearXNG search integration, but its install/configuration pattern can execute the wrong local script and overwrite existing MCP configuration.

Install only after changing the MCP config to use an absolute path to the packaged mcp-server.py, merging the searxng entry into your existing mcporter config instead of overwriting it, and using a trusted SearXNG endpoint for non-sensitive searches.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T07 · Tool Hijacking and Spoofing

Error

• Location: config.json:4
• Finding: Relative MCP Server Path May Execute an Attacker-Controlled Script<![CDATA[ ## Vulnerability Details **File Location**: `config.json`, lines 4–7 **Vulnerability Type**: Untrusted executable resolution through a relative path **Risk Level**: High ### Vulnerable Code ```json "command": "python3", "args": [ "./mcp-server.py" ] ``` ### Technical Analysis The MCP configuration invokes `./mcp-server.py` using a path relative to the MCP client's current working directory. It does not resolve the script relative to the installed Skill directory or another trusted, fixed location. If `mcporter` is started from an attacker-controlled directory containing a malicious file named `mcp-server.py`, Python may execute that file instead of the legitimate server. The malicious file does not need to modify the Skill package or configuration because executable resolution depends on the launch directory. ### Attack Path 1. A user copies the supplied configuration into their global mcporter configuration. 2. An attacker places a malicious `mcp-server.py` in a repository or directory controlled by the attacker. 3. The user starts mcporter while that directory is the current working directory. 4. The configured command runs `python3 ./mcp-server.py`. 5. Python executes the attacker-controlled script with the privileges of the mcporter user. ### Impact Assessment Successful exploitation permits arbitrary Python code execution under the account running mcporter. The attacker could access files available to that user, read inherited environment variables, invoke local programs, communicate over the network, or alter user-owned data. The vulnerability does not independently grant elevated operating-system privileges. Its scope is bounded by the permissions of the affected user and any credentials or environment variables inherited by the MCP process. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Install `mcp-server.py` in a trusted, administrator- or user-owned directory and reference it with an absolute path. - Ensure the script and its containing directory are not writable by untrusted users. - Generate installation-specific configuration rather than distributing a working-directory-relative command. - If portability is required, use a trusted launcher that securely derives the Skill installation directory and validates the target before execution. - Document that users should verify ownership and permissions of the configured executable. Example hardened configuration: ```json "command": "python3", "args": [ "/home/user/.local/share/clawhub/searxng-search/mcp-server.py" ] ``` ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:54
• Finding: Installation Instructions Overwrite the Existing MCP Configuration<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 54–58 **Vulnerability Type**: Unsafe configuration replacement **Risk Level**: Medium ### Vulnerable Code ```markdown ### 1. Configure MCP Server Copy `config.json` to your mcporter config: ```bash cp config.json ~/.config/mcporter/config.json ``` ``` ### Technical Analysis The documented installation command copies the supplied template directly over the user's complete mcporter configuration. It does not test whether the destination already exists, request confirmation, create a backup, or merge only the new `searxng` server entry. Following the command can therefore silently destroy existing server definitions and other user-specific settings. Because the copied file also contains a placeholder endpoint, the resulting configuration may not be operational without additional modification. ### Attack Path 1. A user already has `~/.config/mcporter/config.json` containing trusted MCP server definitions or custom settings. 2. The user follows the documented installation command. 3. `cp` replaces the existing file with the Skill's template. 4. Existing server definitions and configuration values are lost. 5. Subsequent mcporter operations use only the replacement configuration, causing service disruption or unexpected tool availability. ### Impact Assessment The direct impact is loss of user configuration and denial of service for previously configured MCP integrations. It may also alter which tools are available to an agent by removing established server definitions. This issue does not, by itself, provide an attacker with code execution or elevated privileges. Its scope is limited to the target user's mcporter configuration and services dependent on that file. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not instruct users to replace the complete configuration file. - Provide instructions for merging only the `mcpServers.searxng` object into an existing configuration. - Check whether the destination exists and create a timestamped backup before making changes. - Validate the merged JSON before replacing the active configuration. - Write changes to a temporary file in the same directory and use an atomic rename after validation. - Prompt for confirmation when an existing server entry would be replaced. - Clearly instruct users to replace the placeholder `SEARXNG_URL` before enabling the server. At minimum, the documentation should recommend: ```bash mkdir -p ~/.config/mcporter if [ -f ~/.config/mcporter/config.json ]; then cp ~/.config/mcporter/config.json ~/.config/mcporter/config.json.backup fi ``` A JSON-aware merge procedure should then be used instead of copying the template over the destination. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:60
• Finding: Unpinned Global npm Installation Creates Supply-Chain Exposure<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 60–64 **Vulnerability Type**: Unpinned third-party dependency installed globally **Risk Level**: Medium ### Vulnerable Code ```markdown ### 2. Install mcporter ```bash npm install -g mcporter ``` ``` ### Technical Analysis The installation instruction retrieves and globally installs the latest version of `mcporter` without pinning a reviewed version or validating package integrity. Consequently, the dependency installed by a user can differ from the version considered during the Skill audit. npm installations may execute package lifecycle scripts. If the package, a transitive dependency, the registry account, or a future release is compromised, installation can execute changed code on the user's system. The global installation also increases scope by exposing the executable across projects rather than isolating it to this Skill. No evidence was found that the named package is currently malicious; the finding concerns the unsafe and non-reproducible dependency installation practice. ### Attack Path 1. A future package release or dependency is compromised, or unauthorized code is published through a compromised maintainer account. 2. A user follows `npm install -g mcporter` after the compromised release becomes the latest version. 3. npm downloads the changed package and its dependency tree. 4. Any applicable lifecycle scripts run during installation. 5. The compromised executable remains globally available and runs when the user invokes mcporter. ### Impact Assessment A compromised dependency or lifecycle script could execute code with the privileges of the account running npm, access user-readable files and environment variables, modify user-owned data, and establish outbound network connections. If a user runs the command with elevated privileges despite the documentation not requesting it, the impact could extend to system-wide files. Under the documented command alone, the exp ...[truncated 97 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin `mcporter` to a specific reviewed version rather than installing the latest release. - Record and verify package integrity metadata where the installation workflow supports it. - Prefer a project-local dependency with a lockfile over a global installation. - Review the pinned package and its transitive dependencies before updating. - Use automated dependency scanning and controlled update procedures. - Avoid running npm installation commands with elevated privileges. For example: ```bash npm install --save-exact mcporter@<reviewed-version> ``` Commit the generated lockfile and use a reproducible installation command such as `npm ci` after reviewing the dependency tree. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tainted flow: 'url' from os.environ.get (line 79, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

url = f"{SEARXNG_URL}/search?q={encoded_query}&format=json"
    
    try:
        with urllib.request.urlopen(url, timeout=30) as response:
            data = json.loads(response.read().decode('utf-8'))
            results = data.get('results', [])[:limit]
            return results

• Confidence: 90% confidence
• Finding: The server builds a request URL from the unvalidated SEARXNG_URL environment variable and then fetches it with urllib.request.urlopen. If an attacker can influence the runtime environment or deployment configuration, they can redirect requests to arbitrary internal or external hosts, enabling SSRF-style behavior, access to internal services, or use of insecure plaintext HTTP endpoints. In an MCP search skill, this is more dangerous because the tool is explicitly designed to make outbound web requests on behalf of an agent.

Ae1

High

• Category: analysis-evasion

Content

./searxng_search.sh "your search query"

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

./searxng_search.sh "your search query"

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

./searxng_search.sh "your search query"

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill exposes meaningful capabilities—environment access, shell execution, and network access—yet does not declare an explicit tool scope such as permissions or allowed-tools. This creates an avoidable least-privilege gap: agents or operators may grant broader execution authority than intended, increasing the blast radius if the skill is misused or later modified.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation instructs users to send search queries to a configurable remote SearXNG endpoint but does not warn that those queries may contain sensitive prompts, topics, or operational data and will be transmitted to that external service. Because the endpoint is user-configurable and may be third-party, this omission can lead to unintentional data disclosure, logging, or monitoring of agent activity.

Static analysis

No suspicious patterns detected.