Skills/npm/duckduckgo-mcp-server

duckduckgo-mcp-server@0.6.0

CAUTION

Publisher claims: "A Model Context Protocol (MCP) server for DuckDuckGo web and news search" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher ericthered926 · joined 0 days agoInstalls 126KLast detonated 2 h ago

Dispute verdict

Behavior trace

Honeypot run · 2 s · 2 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

1.9sprocessdependency install exit 1

2.0sprocessexec /usr/bin/timeout

2.0sprocessexited 1: Node.js v22.23.4

2.0sclaimedno tools/list reply (exit 1)

2.0sprocessscript backend runs setup only

Static findings

CRITICAL

Access to sensitive file pathsbuild/index.js:49 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsbuild/index.js:17 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

MEDIUM

MCP server using network transport (SSE/HTTP)README.md:7 · MCP server using network transport (SSE/HTTP) — data sent over network

AST04

HIGH

File permission modification commandpackage.json:12 · File permission modification command — agent changes file ownership/permissions

AST05

MEDIUM

MCP server using network transport (SSE/HTTP)README.md:276 · MCP server using network transport (SSE/HTTP) — data sent over network

AST04

MEDIUM

MCP server using network transport (SSE/HTTP)README.md:5 · MCP server using network transport (SSE/HTTP) — data sent over network

AST04

CRITICAL

Access to sensitive file pathsbuild/index.js:34 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsbuild/index.js:35 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05