The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions in SKILL.md direct the user to install a Python package named ddgs (pip install ddgs). The official and widely recognized library for this purpose is duckduckgo-search. The skill explicitly and falsely claims that the package was renamed from duckduckgo-search to ddgs. This pattern is highly characteristic of a typosquatting or dependency confusion attack intended to trick users into installing a third-party package.
[REMOTE_CODE_EXECUTION]: The skill provides numerous Python examples that import from the suspect package (from ddgs import DDGS) and execute its methods. If the ddgs package contains malicious logic, this would result in arbitrary code execution within the environment where the agent executes the code.
[PROMPT_INJECTION]: As a web search utility, the skill processes untrusted content from the internet (search titles and snippets). This creates a vulnerability surface for indirect prompt injection.
Ingestion points: Search results returned by ddgs.text(), ddgs.news(), ddgs.images(), and ddgs.videos() as documented in SKILL.md.
Boundary markers: The instructions do not define any delimiters or system-level instructions to ignore potential commands embedded in search results.
Capability inventory: The skill encourages the use of execute_code for the search itself and suggests following up with web_extract or curl on the discovered URLs, providing a path for multi-step injection attacks.
Sanitization: There is no evidence of output sanitization or filtering to prevent the agent from obeying instructions found within search metadata.

duckduckgo-search