SearXNG Docker

Search the web using a local SearXNG instance (privacy-respecting metasearch engine). Use when user asks to search, look something up, "搜索", "搜一下", "查一下", or...

This skill appears to do what it says: run a local SearXNG container and query it with a simple Python client. Before installing, ensure you have Docker/Docker Compose and review the Docker image (searxng/searxng:latest) if you want to limit supply-chain risk—consider pinning to a specific release tag. Change the placeholder secret (SKILL.md shows an openssl-based sed command) and verify the settings.yml you bind into the container. The service is bound to localhost by default (127.0.0.1:8888) which limits remote exposure; if you change networking, be mindful of who can reach the port. Finally, the included Python script only issues local HTTP requests and prints results; no credentials are requested or exfiltrated.

Type: OpenClaw Skill Name: searxng-docker Version: 1.0.0 The `scripts/searxng_search.py` script allows specifying an arbitrary `--base-url` for the SearXNG instance without validation. This creates a Server-Side Request Forgery (SSRF) vulnerability if an AI agent can be prompted to execute the script with a malicious or internal URL, potentially allowing it to access internal network resources or other services on the host machine. While the skill's stated purpose is to use a local instance, the lack of validation for this argument makes it a significant security flaw. No other clear indicators of intentional malice (e.g., data exfiltration, persistence, obfuscation, or direct prompt injection for harmful actions) were found.