Advanced Searxng Search Skill

Perform privacy-focused metasearch using local or remote SearXNG instances with retries, timeouts, category, time, and engine-specific filters.

This package appears to implement exactly what it says (a client for SearXNG instances) and does not request unrelated credentials. However, several red flags should be resolved before installing: 1) the registry lists no install spec but the skill includes packaging metadata and SKILL.md suggests pip install — verify the package source (PyPI or a trustworthy GitHub repo) before running pip; 2) setup.py advertises a CLI entrypoint searxng_skill.cli:main but no cli.py is present in the bundle — that suggests a mispackaged or incomplete release; 3) SKILL.md/README reference inconsistent repository/usernames — confirm the authoritative upstream; 4) prefer pointing the skill at a local or trusted SearXNG instance (default is localhost) rather than accepting a remote URL you don't control; and 5) if you plan to install, review the repository contents (especially any missing/extra files), run installation in a sandbox or VM, and inspect network calls (or run with network disabled) until you trust the package. If the author or a well-known source (PyPI/GitHub org) can't be confirmed, treat installation as higher risk.

Type: OpenClaw Skill Name: searxng-search-skill Version: 0.1.1 The skill is designed to interact with a SearXNG metasearch instance, which involves making HTTP requests to a configurable `instance_url` (searxng_skill/core.py). It also includes functionality to export search results to local files at a user-specified `filepath` (searxng_skill/utils.py). While these capabilities align with the stated purpose of a search skill, they introduce a vulnerability risk if the `instance_url` or `filepath` parameters are controlled by an attacker (e.g., via prompt injection against the agent using this skill) to target malicious endpoints or write to sensitive file system locations. There is no evidence of intentional malicious behavior within the skill's code or instructions, but the broad capabilities could be exploited.