Searxng 1

Privacy-respecting metasearch using your local SearXNG instance. Search the web, images, news, and more without external API dependencies.

This skill appears to do what it says: query a SearXNG JSON API and present results. Before installing: (1) Confirm you run or trust the SearXNG instance you set in SEARXNG_URL (the script defaults to http://localhost:8080). (2) Install Python dependencies (httpx, rich) from trusted package sources. (3) If you point SEARXNG_URL to a remote/non-local endpoint, change verify=False to verify=True (and remove suppressed SSL warnings) to avoid MITM risk — the script currently disables SSL verification for convenience with self-signed certs. (4) Note the documentation mismatch: the registry metadata omits the required SEARXNG_URL env var; set it in your agent config or shell. (5) Run the script in an isolated environment if you want extra assurance and inspect the code yourself; there are no hidden network endpoints or credential exfiltration code in the included files.

Type: OpenClaw Skill Name: searxng-1 Version: 1.0.1 The skill is classified as suspicious due to the combination of a user-configurable `SEARXNG_URL` environment variable and the `verify=False` setting in the `httpx.get` request within `scripts/searxng.py`. While intended for local SearXNG instances with self-signed certificates, this creates a significant Server-Side Request Forgery (SSRF) and Man-in-the-Middle (MITM) vulnerability if an attacker can control the `SEARXNG_URL` environment variable. The skill itself does not exhibit malicious intent, but these design choices introduce high-risk capabilities that could be exploited.