skills/aahl/skills/mcp-duckgo/Socket

mcp-duckgo

Warn

Audited by Socket on Sep 15, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS. The skill’s purpose matches its search/scraping behavior, and no credential theft is evident, but it relies on an unpinned two-stage runtime install chain and a third-party DuckDuckGo MCP server. The biggest security issue is indirect prompt injection from untrusted web content, plus moderate supply-chain exposure from executing mutable external packages.

Confidence: 88%Severity: 68%

Audit Metadata

Analyzed At

Sep 15, 2026, 03:24 PM

Package URL

pkg:socket/skills-sh/aahl%2Fskills%2Fmcp-duckgo%2F@7dec5e3500d96bbf419b9df57b384a3081459ebfca933e0eae4043ea477a7e08