Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward Brave Answers API usage skill that sends prompts to Brave when used, which matches its stated purpose.
Use this only for prompts you are comfortable sending to Brave with your Brave API key. Avoid secrets, private internal documents, personal data, or regulated data unless your policy allows it, and monitor cost/usage especially when research mode is enabled.
The skill routes user-provided prompts to Brave's external /chat/completions API, but the skill description and usage guidance do not clearly warn users that their prompt contents will be transmitted to a third party. This creates a privacy and data-handling risk because users may unknowingly send sensitive or regulated information outside the local system boundary.
This example performs a POST request to Brave's external API and includes user message content in the transmitted JSON body. External transmission is expected for this skill's purpose, but it is still security-relevant because prompts may contain sensitive data and the documentation does not pair the example with prominent privacy warnings or data-minimization guidance.
curl -X POST "https://api.search.brave.com/res/v1/chat/completions" \
-H "Content-Type: application/json" \
-H "X-Subscription-Token: ${BRAVE_SEARCH_API_KEY}" \
-d '{
This example performs a POST request to Brave's external API and includes user message content in the transmitted JSON body. External transmission is expected for this skill's purpose, but it is still security-relevant because prompts may contain sensitive data and the documentation does not pair the example with prominent privacy warnings or data-minimization guidance.
curl -X POST "https://api.search.brave.com/res/v1/chat/completions" \
-H "Content-Type: application/json" \
-H "X-Subscription-Token: ${BRAVE_SEARCH_API_KEY}" \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST "https://api.search.brave.com/res/v1/chat/completions" \
-H "Content-Type: application/json" \
-H "X-Subscription-Token: ${BRAVE_SEARCH_API_KEY}" \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST "https://api.search.brave.com/res/v1/chat/completions" \
-H "Content-Type: application/json" \
-H "X-Subscription-Token: ${BRAVE_SEARCH_API_KEY}" \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST "https://api.search.brave.com/res/v1/chat/completions" \
-H "Content-Type: application/json" \
-H "X-Subscription-Token: ${BRAVE_SEARCH_API_KEY}" \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST "https://api.search.brave.com/res/v1/chat/completions" \
-H "Content-Type: application/json" \
-H "X-Subscription-Token: ${BRAVE_SEARCH_API_KEY}" \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST "https://api.search.brave.com/res/v1/chat/completions" \
-H "Content-Type: application/json" \
-H "X-Subscription-Token: ${BRAVE_SEARCH_API_KEY}" \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST "https://api.search.brave.com/res/v1/chat/completions" \
-H "Content-Type: application/json" \
-H "X-Subscription-Token: ${BRAVE_SEARCH_API_KEY}" \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST "https://api.search.brave.com/res/v1/chat/completions" \
-H "Content-Type: application/json" \
-H "X-Subscription-Token: ${BRAVE_SEARCH_API_KEY}" \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST "https://api.search.brave.com/res/v1/chat/completions" \
-H "Content-Type: application/json" \
-H "X-Subscription-Token: ${BRAVE_SEARCH_API_KEY}" \
-d '{
No suspicious patterns detected.