ClawHub
Back to skill

Security audit

Searxng Search

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent SearXNG search integration, but its install/configuration pattern can execute the wrong local script and overwrite existing MCP configuration.

Install only after changing the MCP config to use an absolute path to the packaged mcp-server.py, merging the searxng entry into your existing mcporter config instead of overwriting it, and using a trusted SearXNG endpoint for non-sensitive searches.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T07 · Tool Hijacking and Spoofing

Error
Location
config.json:4
Finding

Relative MCP Server Path May Execute an Attacker-Controlled Script

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:54
Finding

Installation Instructions Overwrite the Existing MCP Configuration

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:60
Finding

Unpinned Global npm Installation Creates Supply-Chain Exposure

Content
View full analysis
Remediation
View remediation
``` Commit the generated lockfile and use a reproducible installation command such as `npm ci` after reviewing the dependency tree. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Tainted flow: 'url' from os.environ.get (line 79, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

The server builds a request URL from the unvalidated SEARXNG_URL environment variable and then fetches it with urllib.request.urlopen. If an attacker can influence the runtime environment or deployment configuration, they can redirect requests to arbitrary internal or external hosts, enabling SSRF-style behavior, access to internal services, or use of insecure plaintext HTTP endpoints. In an MCP search skill, this is more dangerous because the tool is explicitly designed to make outbound web requests on behalf of an agent.

Content

Scanner excerpt · mcp-server.py (reported line 82)May include surrounding context.

python
url = f"{SEARXNG_URL}/search?q={encoded_query}&format=json"
    
    try:
        with urllib.request.urlopen(url, timeout=30) as response:
            data = json.loads(response.read().decode('utf-8'))
            results = data.get('results', [])[:limit]
            return results

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md
./searxng_search.sh "your search query"

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

md
./searxng_search.sh "your search query"

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md
./searxng_search.sh "your search query"

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill exposes meaningful capabilities—environment access, shell execution, and network access—yet does not declare an explicit tool scope such as permissions or allowed-tools. This creates an avoidable least-privilege gap: agents or operators may grant broader execution authority than intended, increasing the blast radius if the skill is misused or later modified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The documentation instructs users to send search queries to a configurable remote SearXNG endpoint but does not warn that those queries may contain sensitive prompts, topics, or operational data and will be transmitted to that external service. Because the endpoint is user-configurable and may be third-party, this omission can lead to unintentional data disclosure, logging, or monitoring of agent activity.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.