SearXNG Search CLI (Free, Self-hosted, Auto-deploy, Multi-Channel)

Use self-hosted SearXNG search engine (Free, Self-hosted, Auto-deploy, Multi-Channel). SearXNG is a free meta search engine that aggregates 200+ search engin...

This skill appears to do what it claims (install and run a self-hosted SearXNG) but its installer performs sensitive operations: it downloads and executes a remote install script (curl | sh), clones code from GitHub, edits configuration files, copies limiter.toml to /etc (may require sudo), and writes/enables a systemd service. Before installing: (1) do not run the installer on your main machine — prefer a disposable VM or container; (2) inspect the remote install script (https://astral.sh/uv/install.sh) or install 'uv' manually instead of piping to sh; (3) avoid running commands with sudo blindly and review any files copied to /etc; (4) ensure the service is bound to localhost and keep SEARXNG_SECRET private; (5) if you only need search results, prefer connecting to an already-running trusted instance rather than running the install. If you want, I can list the exact lines that are risky or produce a safe alternative set of commands to install in a container.

Type: OpenClaw Skill Name: searxng-search-cli Version: 1.2.1 The skill bundle automates the installation and management of a SearXNG instance but employs high-risk execution patterns. Specifically, `scripts/searxng_cli.py` uses `curl | sh` to install the 'uv' package manager and frequently invokes `subprocess.run` with `shell=True`, creating a significant shell injection surface. Additionally, `ONBOARDING.md` and the script logic encourage the use of `sudo` for system-level changes, such as modifying `/etc/searxng/` and creating symlinks in `/usr/local/bin`. While these behaviors are consistent with the tool's stated purpose of 'one-click installation,' the reliance on unverified remote scripts and broad shell execution permissions represents a high-risk profile.