ClawHub

Answers

Security checks across malware telemetry and agentic risk

Overview

This skill is a documentation-only helper for using Brave's Answers API, with expected external prompt transmission and no hidden code or persistence found.

Install only if you are comfortable sending the questions you ask through this skill, and any research-mode derived queries, to Brave's API using your Brave API key and quota. Do not include secrets, credentials, regulated data, or sensitive internal information unless that sharing is approved for your use case.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (11)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill clearly instructs users to send prompts and other message content to Brave's remote `/chat/completions` endpoint, but it does not prominently warn that user inputs will leave the local environment and be processed by a third party. In an agent setting, this can lead to unintentional transmission of sensitive user data, credentials, internal documents, or regulated information.

External Transmission

Medium
Category
Data Exfiltration
Content
### Blocking (Single-Search)
```bash
curl -X POST "https://api.search.brave.com/res/v1/chat/completions" \
  -H "Content-Type: application/json" \
  -H "X-Subscription-Token: ${BRAVE_SEARCH_API_KEY}" \
  -d '{
Confidence
95% confidence
Finding
curl -X POST "https://api.search.brave.com/res/v1/chat/completions" \ -H "Content-Type: application/json" \ -H "X-Subscription-Token: ${BRAVE_SEARCH_API_KEY}" \ -d '{ "messages": [{"role": "

External Transmission

Medium
Category
Data Exfiltration
Content
### Blocking (Single-Search)
```bash
curl -X POST "https://api.search.brave.com/res/v1/chat/completions" \
  -H "Content-Type: application/json" \
  -H "X-Subscription-Token: ${BRAVE_SEARCH_API_KEY}" \
  -d '{
Confidence
95% confidence
Finding
https://api.search.brave.com/

External Transmission

Medium
Category
Data Exfiltration
Content
### Streaming with Citations (Single-Search)
```bash
curl -X POST "https://api.search.brave.com/res/v1/chat/completions" \
  -H "Content-Type: application/json" \
  -H "X-Subscription-Token: ${BRAVE_SEARCH_API_KEY}" \
  -d '{
Confidence
94% confidence
Finding
https://api.search.brave.com/

External Transmission

Medium
Category
Data Exfiltration
Content
### Research Mode
```bash
curl -X POST "https://api.search.brave.com/res/v1/chat/completions" \
  -H "Content-Type: application/json" \
  -H "X-Subscription-Token: ${BRAVE_SEARCH_API_KEY}" \
  -d '{
Confidence
95% confidence
Finding
https://api.search.brave.com/

External Transmission

Medium
Category
Data Exfiltration
Content
## Endpoint

```http
POST https://api.search.brave.com/res/v1/chat/completions
```

**Authentication**: `X-Subscription-Token: <API_KEY>` header (or `Authorization: Bearer <API_KEY>`)
Confidence
93% confidence
Finding
https://api.search.brave.com/

External Transmission

Medium
Category
Data Exfiltration
Content
**Authentication**: `X-Subscription-Token: <API_KEY>` header (or `Authorization: Bearer <API_KEY>`)

**SDK Compatible**: Works with OpenAI SDK via `base_url="https://api.search.brave.com/res/v1"`

## Two Modes
Confidence
91% confidence
Finding
https://api.search.brave.com/

External Transmission

Medium
Category
Data Exfiltration
Content
from openai import OpenAI

client = OpenAI(
    base_url="https://api.search.brave.com/res/v1",
    api_key="your-brave-api-key",
)
Confidence
92% confidence
Finding
https://api.search.brave.com/

External Transmission

Medium
Category
Data Exfiltration
Content
from openai import OpenAI

client = OpenAI(
    base_url="https://api.search.brave.com/res/v1",
    api_key="your-brave-api-key",
)
Confidence
92% confidence
Finding
https://api.search.brave.com/

External Transmission

Medium
Category
Data Exfiltration
Content
from openai import AsyncOpenAI

client = AsyncOpenAI(
    base_url="https://api.search.brave.com/res/v1",
    api_key="your-brave-api-key",
)
Confidence
94% confidence
Finding
https://api.search.brave.com/

External Transmission

Medium
Category
Data Exfiltration
Content
## Use Cases

- **Chat interface integration**: Drop-in OpenAI SDK replacement with web-grounded answers. Set `base_url="https://api.search.brave.com/res/v1"`.
- **Deep research / comprehensive topic research**: Use research mode (`enable_research=true`) for complex questions needing multi-source synthesis (e.g., "Compare approaches to nuclear fusion").
- **OpenAI SDK drop-in**: Same SDK, same streaming format — just change `base_url` and `api_key`. Works with both sync and async clients.
- **Cited answers**: Enable `enable_citations=true` in single-search mode for inline citation tags, or use research mode which automatically includes citations in its answer.
Confidence
89% confidence
Finding
https://api.search.brave.com/

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal