Searxng Web

Security checks across malware telemetry and agentic risk

Overview

This skill does what it claims: it sends search queries to a local SearXNG service and returns search results.

Install this only if you trust the SearXNG service running at host.docker.internal:8081. Avoid putting secrets or highly private text into search queries, because those queries will be sent to that local service.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: This code reads a query from stdin and transmits it over HTTP to an external service at host.docker.internal:8081/search. The file contains no confirmation prompt, warning comment, docstring, or user-facing log explaining that user input will be sent over the network.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal