My Searxng

Privacy-respecting metasearch using your local SearXNG instance. Search the web, images, news, and more without external API dependencies.

This skill appears to do what it says: it runs a local-API search via the included Python script. Before installing or running it: 1) Open scripts/searxng.ini and set the url to your own trusted SearXNG instance (do not rely on the provided default 192.168.1.20:4000 unless it is yours). 2) Be aware the script disables SSL certificate verification for HTTPS (it allows self-signed certs); if you need stronger protection, run your instance with a valid cert or modify the code to enforce verification. 3) The script will send your search queries to whatever URL is configured — treat that endpoint as able to observe/search logs. 4) The code is zero-dependency and straightforward; if you want stronger assurance, review or run the script locally before granting usage. If you want, I can point out the exact lines to change to re-enable certificate verification or to validate the configured URL before requests.

Type: OpenClaw Skill Name: my-searxng Version: 1.0.0 The skill provides a search interface for SearXNG but contains a security vulnerability in `scripts/searxng.py` where SSL certificate verification is explicitly disabled (`ssl.CERT_NONE`), potentially exposing users to man-in-the-middle attacks. The script also performs local file writes to `scripts/searxng.ini` to manage its configuration. While these behaviors are documented as being for local instance compatibility and are aligned with the stated purpose, they represent risky capabilities and vulnerabilities according to the analysis criteria.