Agent Economy ReportAgent Economy ReportSAFE version 1.0.0 · audited 2026-09-17
This skill is a short instruction manual for an AI agent that needs to search the web without an API key. It tells the agent to use a built-in web_fetch tool to query DuckDuckGo Lite and then fetch pages from the search results. The package contains no executable program, install script, or hidden network destinations beyond DuckDuckGo and the search result pages themselves. It explicitly warns users not to put secrets or private data in search queries or fetched URLs. Nothing in the files tries to access credentials, payments, file storage, or persistence. The behavior matches the declared purpose.
| Declared purpose | Web search without an API key using DuckDuckGo Lite via web_fetch. Use as a fallback when web_search fails with missing_brave_api_key error, or whenever you need to search the web and no search API is configured. Provides titles, URLs, and snippets for research queries. |
| Observed behavior | The package is documentation only. It contains no executable scripts, shell commands, file writes, or install routines. It instructs an agent to use the built-in web_fetch tool against lite.duckduckgo.com, optionally with region parameters, and then fetch selected result URLs. The skill card discloses that search terms and fetched URLs are sent to external services and advises against including secrets or private data. |
| Verdict, rules only | SAFE |
| Verdict, AI | SAFE |
| Final verdict | SAFE (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| network | needed | The skill requires the agent to make web requests via web_fetch to DuckDuckGo Lite and to any result URLs the agent selects from search results. |
| severity | finding |
|---|---|
| info | Declared purpose The skill describes itself as a no-API-key web search fallback using DuckDuckGo Lite and the host agent's web_fetch tool. SKILL.md:3 Web search without an API key using DuckDuckGo Lite via web_fetch. Use as a fallback when web_search fails with missing_brave_api_key error, or whenever you nee |
| info | Primary search request Instructs the agent to send a search query to lite.duckduckgo.com using web_fetch. SKILL.md:13 web_fetch(url="https://lite.duckduckgo.com/lite/?q=QUERY", extractMode="text", maxChars=8000) |
| info | Regional search example Shows an example search request with a region filter, still only targeting DuckDuckGo Lite. SKILL.md:35 web_fetch(url="https://lite.duckduckgo.com/lite/?q=best+coffee+melbourne&kl=au-en", extractMode="text", maxChars=8000) |
| low | Fetch arbitrary result pages The agent is instructed to fetch URLs returned by search results. Those URLs are not fixed and may include third-party sites, which is a standard search-then-fetch pattern but should be reviewed by cautious users. SKILL.md:46 3. **Fetch** — use `web_fetch` on those URLs to read full content |
| info | External service disclosure The package discloses that search query terms and fetched page URLs are sent to external web services. skill-card.md:24 Risk: Search query terms and fetched page URLs are sent to external web services. |
| info | Credential safety guidance The package tells users not to include secrets, credentials, private data, or confidential business details in queries or fetched URLs. No separate credential access was found. skill-card.md:26 Mitigation: Do not include secrets, credentials, private data, or confidential business details in search queries or fetched URLs. |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawhub.ai | not in the service index | skill-card.md:9 |
| duckduckgo.com | not in the service index | SKILL.md:30 |
| lite.duckduckgo.com | not in the service index | SKILL.md:13 |
| Binaries invoked | none |
| Environment variables read | none |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 0 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 59 | e682629ecedd2a79… |
_meta.json | 6 | 7aa6c6ef6d5f0e7c… |
skill-card.md | 54 | 791c809cadee7cb3… |
For agents
JSON: https://agenteconomy.report/k/ddg-web-search.audit.json · badge: https://agenteconomy.report/k/ddg-web-search.audited.svg ·
skill rating: /k/ddg-web-search · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).