web_search
Privacy-respecting metasearch using your local SearXNG instance. Search the web, images, news, and more without external API dependencies.
Security
2 findings: 1 critical severity, 1 high severity. Installing this skill is not recommended: please review these findings carefully if you do intend to do so.
E005: Suspicious download URL detected in skill instructions.
What this means
Detected a suspicious URL in the skill instructions that could lead the agent to download and execute malicious scripts or binaries. This includes links to executables from untrusted sources, typosquatting of official packages, URL shorteners that obscure the destination, and personal file hosting services.
Why it was flagged
These URLs include torrent/piracy indexes, shadow library/archive mirrors and an .onion search endpoint — categories of sites commonly used to host or link to untrusted/pirated files that are high-risk sources for malware distribution.
W008: Secret detected in skill content (API keys, tokens, passwords).
What this means
Detected sensitive credentials directly embedded within the skill content, such as API keys, access tokens, private keys, or service-specific secrets. Secrets should never be hardcoded in plain text within skill instructions.
Why it was flagged
I flagged config/settings.yml:91 because it contains a literal, random-looking secret_key value ("3dyhyagbXrD8IqQVVYgWMB94MFAXud") that meets the definition of a high-entropy credential that could be used by the service. Although the file comment notes it may be overwritten by an environment variable, the hardcoded value is directly present and should be treated as a secret. Other values in the repository were ignored because they are placeholders, examples, comments, or low-entropy: - Many api_key/token fields are empty, set to obvious placeholders (e.g., "token", "apikey"), or commented-out example lines — these are documentation placeholders and not real secrets. - SEARXNG_URL and other URLs/defaults are non-secret configuration defaults (e.g., http://localhost:8080). - ownerId in _meta.json is an identifier, not a credential. Therefore only the secret_key literal was flagged.
- Repository
- huangruiteng/CS-Notes
- Commit
43eb317
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.