DDuckDuckGo Search MCP ServerMirror of

mcp-so:nickclyde_duckduckgo-mcp-server_MCP-Mirror

View source

100/100

First Seen

Feb 18, 2026

Last Scanned

Feb 20, 2026

Findings

Score

100/100

LOW 2

Findings (2)

LOW

npx auto-install without confirmation EXTDL_003

external-download L44

Detects npx with -y flag that bypasses user confirmation for package installation

npx -y

FIX

Replace npx -y with an explicit npm install step that pins the package to a specific version, then run it. Remove the -y flag to require user confirmation.

FP?

Likely FP if the npx command runs a well-known, trusted tool (e.g., create-react-app) in documentation context with no version pinning concern.

LOW

pip install arbitrary package EXTDL_009

external-download L46

Detects pip install of arbitrary packages that modify the host environment

pip install du

FIX

Pin all pip packages to exact versions (e.g., pip install package==1.2.3). Use a requirements.txt or pyproject.toml with pinned versions and hash verification.

FP?

Likely FP if the match is in documentation showing how to install the skill's own PyPI package.