Agent Economy ReportAgent Economy ReportCAUTION version 1.0.3 · audited 2026-09-09
This skill is a small command-line search tool that sends your search query to a SearXNG metasearch server (by default one running on your own machine at http://localhost:8080, or whatever URL you set in SEARXNG_URL) and prints the results as a table or JSON. The code is short, readable, and does nothing beyond that: no file writes, no shell execution, no credential access, no hidden network destinations, and no downloading of extra code. The one real weakness is that HTTPS certificate checking is turned off (verify=False) and the corresponding warning is silenced, so if you point it at a remote HTTPS instance the connection could be intercepted without any visible error. Because the tool feeds third-party web page titles and snippets back into the agent's context, those results are untrusted text that could contain instructions aimed at the agent — an inherent property of any search tool rather than something malicious here. The bundled PUBLISH.md/PUBLISHING_CHECKLIST.md are the author's own release notes and contain no executable content. Overall the behavior matches the stated purpose.
Instructions try to steer the agent beyond the declared purpose. Search result titles, URLs and content snippets fetched from the configured instance are printed verbatim into the agent's output stream (scripts/searxng.py line 122 `content = result.get("content", "")[:200]` and line 127). Any third-party web content returned by the SearXNG instance therefore enters the agent's context as untrusted text. This is inherent to search tools; the package itself contains no instructions attempting to override agent rules.
| Declared purpose | Privacy-respecting web/image/news/video metasearch through a user-configured SearXNG instance, with no external API keys required. |
| Observed behavior | scripts/searxng.py builds a query string and performs a single HTTP GET to $SEARXNG_URL/search (default http://localhost:8080) with format=json, then truncates and prints the results either as a rich table or as raw JSON. It reads one environment variable (SEARXNG_URL), reads no files, writes no files, spawns no processes, and contacts no host other than the one the user configures. TLS verification is explicitly disabled for that request and the related Python warning is suppressed. |
| Verdict, rules only | SAFE |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| network | needed | HTTP GET to f"{SEARXNG_URL}/search" via httpx (scripts/searxng.py line 61-66). Destination is entirely user-controlled; default is localhost:8080. |
| other | needed | Reads the non-sensitive SEARXNG_URL environment variable (scripts/searxng.py line 23). Installs Python deps httpx and rich via PEP 723 inline metadata when run with `uv run` (lines 2-5). |
| install_packages | needed | Inline script metadata declares dependencies = ["httpx", "rich"], which `uv run` resolves and installs into an ephemeral environment; both are well-known mainstream packages. |
| severity | finding |
|---|---|
| medium | TLS certificate verification disabled for all requests Certificate verification is unconditionally off, not just for localhost. If a user sets SEARXNG_URL to an https:// remote instance (as both SKILL.md line 46 and README.md line 60 suggest), the connection is vulnerable to interception and the search queries/results could be read or altered by a network attacker. A safer design would only relax verification for loopback hosts or expose an opt-in flag. scripts/searxng.py:65 verify=False # For local self-signed certs |
| low | Insecure-transport warning suppressed The warning that would normally tell the user their HTTPS connection is unverified is silenced, so the weakened transport security is invisible at runtime. scripts/searxng.py:20 warnings.filterwarnings('ignore', message='Unverified HTTPS request') |
| info | Disabled TLS verification is documented, with manual fix instructions The author discloses the behavior and tells users how to re-enable verification, which mitigates the surprise factor but still leaves insecure behavior as the default. README.md:128 The skill is configured to work with self-signed certificates (common for local SearXNG instances). If you need strict SSL verification, edit the script and cha |
| info | Single, fully user-controlled network destination The only outbound destination is the URL the user configures; there is no hardcoded third-party endpoint. CHANGELOG.md lines 11-17 note that an earlier version shipped a hardcoded private URL which was removed in 1.0.1. scripts/searxng.py:23 SEARXNG_URL = os.getenv("SEARXNG_URL", "http://localhost:8080") |
| low | Untrusted web content is rendered into agent output Titles, URLs and snippets from arbitrary websites are printed without sanitisation. An agent consuming this output may treat embedded text as instructions (indirect prompt injection). Inherent to search tooling, but relevant for an agent holding credentials or spending money. scripts/searxng.py:122 content = result.get("content", "")[:200] |
| info | Version mismatch between registry metadata and package contents The registry records version 1.0.3 while SKILL.md line 5 and CHANGELOG.md top entry say 1.0.1. No code difference is visible in this package, but the inconsistency makes it harder to verify exactly which release you are installing. _meta.json:4 "version": "1.0.3", |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawdhub.com | not in the service index | PUBLISH.md:65 |
| clawhub.ai | not in the service index | skill-card.md:7 |
| docs.searxng.org | not in the service index | README.md:16 |
| keepachangelog.com | not in the service index | CHANGELOG.md:5 |
| searxng.org | not in the service index | SKILL.md:6 |
| semver.org | not in the service index | CHANGELOG.md:6 |
| your-searxng-instance.com | not in the service index | README.md:53 |
| Binaries invoked | bash, curl, docker, python, python3, uv |
| Environment variables read | SEARXNG_URL |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 0 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
CHANGELOG.md | 38 | 150826dce7f0c825… |
PUBLISH.md | 147 | 7f4eaf0be625faf5… |
PUBLISHING_CHECKLIST.md | 111 | 25db692f19206df9… |
README.md | 168 | 47359f5934aa56fe… |
SKILL.md | 70 | 6ab813a3ef5aab63… |
_meta.json | 6 | c9f859a2f301b663… |
scripts/searxng.py | 211 | 9089ca995b66a243… |
skill-card.md | 42 | d4680146300d79da… |
For agents
JSON: https://agenteconomy.report/k/searxng.audit.json · badge: https://agenteconomy.report/k/searxng.audited.svg ·
skill rating: /k/searxng · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).