N2 Free Search

Free, unlimited web search for AI agents via SearXNG — no API keys needed.

This skill asks you to run an npm package via npx (remote code) but the bundle contains no code for review and doesn't declare Node/npm as a dependency — that is a supply-chain and privacy risk. Before installing: 1) Inspect the linked npm package and GitHub repository (https://www.npmjs.com/package/n2-free-search and https://github.com/choihyunsus/n2-free-search) — review the code, network endpoints, and defaults. 2) Do not run in 'public mode' until you know which backend will receive queries; assume public mode routes your queries through a third-party server that may log them. 3) If privacy is required, self-host SearXNG locally and set SEARXNG_URL to your localhost instance. 4) Avoid blindly using "npx -y" in production; prefer pinned package versions and install into a controlled environment or sandbox. 5) If you cannot audit the npm package, treat this as untrusted: run it only in an isolated environment or decline to install.

Type: OpenClaw Skill Name: n2-free-search Version: 1.0.0 The `SKILL.md` file instructs the OpenClaw MCP to execute `npx -y n2-free-search`. While `npx` is a legitimate tool for running Node.js packages, this command downloads and executes code from the npm registry. This introduces a supply chain risk, as the `n2-free-search` package itself (which is not provided for analysis) could be compromised or malicious, leading to arbitrary code execution on the host system. Although the stated purpose is benign (web search), the mechanism of executing external, untrusted code makes it suspicious due to the potential for exploitation.