websearch

SUSPICIOUS. The skill’s capabilities broadly fit its purpose, but it routes all web search/fetch through a non-native third-party CLI/MCP backend with partially opaque downstream endpoints such as searx rescue. No credential harvesting or overtly malicious behavior is shown, yet the external dependency and variable data path make it medium risk rather than benign.