Skills/npm/modsearch

modsearch@5.10.12

CAUTION· install only

Publisher claims: "The strongest free web search plugin for coding agents. Plug-in web search, X search, and page fetch for models without native web access. Free out of the box: no signup, no API key (Firecrawl keyless, 1,000 free credits/month)" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher liustack · publishing for 265 daysInstalls 75,895Last detonated 6d ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-08 and scored it 77/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Pipe-to-shell pattern; Pipe-to-shell pattern. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

MEDIUM
Remote installer piped to shelldist/main.js:2808 · Remote installer piped to shellconst INSTALL_GROK = "curl -fsSL https://x.ai/cli/install.sh | bash && grok";Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
LOW
Image alt text carrying instructionsREADME.md:108 · Image alt text carrying instructions · informational: not an instruction fileThe ModSearch page in the dsh Plugins panel, shown in Chinese: pick the preferred engine, fill in an API key and endpoint, tick the engines that join failoverFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
CRITICAL
Pipe-to-shell patterndist/main.js:2807 · Pipe-to-shell pattern — downloads and immediately executes remote codeconst INSTALL_AGY = "curl -fsSL https://antigravity.google/cli/install.sh | bash && agy";Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
npx invocation of non-well-known packageskills/modsearch/scripts/run.sh:70 · npx invocation of non-well-known package — may execute untrusted code# The npx path runs the CLI on this machine's node, so npx is only usable whenFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageskills/modsearch/scripts/run.sh:96 · npx invocation of non-well-known package — may execute untrusted codeif command -v npx >/dev/null 2>&1 && node_meets_floor; thenFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedsh/index.js:187 · npx invocation of non-well-known package — may execute untrusted code…ns X itself was unreachable and a keyless web search answered second-hand. Run `npx @liustack/modsearch doctor` to inspect the resolved engines.', parameters: { type: 'objec…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
CRITICAL
Pipe-to-shell patterndist/main.js:2808 · Pipe-to-shell pattern — downloads and immediately executes remote codeconst INSTALL_GROK = "curl -fsSL https://x.ai/cli/install.sh | bash && grok";Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
File permission modification commanddist/main.js:3064 · File permission modification command — agent changes file ownership/permissions...permissionsOk ? {} : { note: `group/world can read this file. Run: chmod 600 ${configPath}` },Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
npx invocation of non-well-known packageskills/modsearch/scripts/run.sh:71 · npx invocation of non-well-known package — may execute untrusted code# node itself meets the CLI's floor. An old node with a working npx used to beFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageskills/modsearch/SKILL.md:45 · npx invocation of non-well-known package — may execute untrusted code2. Otherwise, if `npx` exists: `npx --yes --package @liustack/[email protected] modsearch <args>`.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Remote installer piped to shelldist/main.js:2807 · Remote installer piped to shellconst INSTALL_AGY = "curl -fsSL https://antigravity.google/cli/install.sh | bash && agy";Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
npx invocation of non-well-known packagedsh/index.js:260 · npx invocation of non-well-known package — may execute untrusted code…ode. Private-network URLs are blocked. Page reading needs no engine setup. Run `npx @liustack/modsearch doctor` to inspect the resolved route.', parameters: { type: 'object'…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageskills/modsearch/scripts/run.sh:11 · npx invocation of non-well-known package — may execute untrusted code# 2. npx present -> run the pinned npm version.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedsh/index.js:371 · npx invocation of non-well-known package — may execute untrusted code'Run `npx @liustack/modsearch doctor` in a terminal to check the engine setup.',Fix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈2,707 tok
1 file · 35 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

No advisories in OSV for @liustack/modsearch@5.10.12 as of 6d ago. This is the package itself, not its dependencies.

What would make this Verified

3 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  2. Unclaimed publisher≈ +8 on the totalClaim liustack: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Remote installer piped to shell≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  4. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
  5. File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim liustackPropose a patch to the maintainer