Searxng Backup

Privacy-respecting metasearch using your local SearXNG instance. Search the web, images, news, and more without external API dependencies.

This skill appears to implement a local SearXNG search client and is generally coherent with that purpose, but there are several issues to consider before installing: (1) Metadata mismatches — the registry listing, SKILL.md, and _meta.json use different owner IDs and version numbers; verify the publisher/author before trusting the package. (2) The SKILL.md requires SEARXNG_URL but the registry metadata claims no env vars — make sure you set SEARXNG_URL to a SearXNG instance you control (preferably localhost). (3) The script disables SSL verification (verify=False) and suppresses warnings to support self-signed certificates; if you point SEARXNG_URL to anything other than a local/trusted instance this could expose your queries to interception. Consider editing the script to enable verify=True if you use a proper TLS cert. (4) There is no install spec for Python dependencies (httpx, rich). Install those in a virtualenv before running. (5) If you need higher assurance, ask the publisher to reconcile metadata (ownerId/version) and provide an install specification or signed release. If you proceed, run the skill in an isolated environment and ensure SEARXNG_URL points to a host you control.

Type: OpenClaw Skill Name: searxng-backup Version: 1.0.0 The skill provides a search interface for SearXNG but contains a security vulnerability in `scripts/searxng.py` where SSL certificate verification is explicitly disabled (`verify=False`) and associated warnings are suppressed. While the documentation states this is for local self-signed certificates, this flaw allows for potential Man-in-the-Middle (MITM) attacks if the agent is configured to use a remote or public SearXNG instance via the `SEARXNG_URL` environment variable.