T08 · Insecure Dependencies
Warning
- Location
SKILL.md:10- Finding
Unpinned Third-Party Dependencies and Runtime Package Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
Brave Search
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent Brave search wrapper, but it should be reviewed because it automatically falls back to a shared demo gateway key and relies on unpinned third-party package execution.
Install only if you are comfortable sending search queries through the OneKey Gateway. Prefer setting your own DEEPNLP_ONEKEY_ROUTER_ACCESS key, avoid relying on the shared demo key, pin and verify dependency versions before running npm, pip, or npx commands, and run the skill in a restricted environment if possible.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/brave_web_search.py:8- Finding
Public Hard-Coded Fallback Gateway Credential
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill declares environment-variable use and references local scripts, but it does not define an explicit tool scope such as permissions or allowed-tools. That omission can lead to overbroad runtime behavior and makes it harder for operators to understand or constrain what the skill may access, especially where secrets and file reads are involved.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation states that scripts fall back to a shared demo key, which encourages users to send queries through a common credential without clear warning about privacy, attribution, logging, quota abuse, or service-account ownership. Shared credentials reduce accountability and can expose user activity or data to third parties operating or monitoring that demo account.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 89% confidence
- Finding
Using
npx onekeywithout a pinned version allows whatever package version is currently resolved from the registry to be executed. This creates a supply-chain risk: a compromised, malicious, or breaking upstream release could be pulled at runtime and run with the user's environment and API credentials available.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 89% confidence
- Finding
This is a second occurrence of the same unpinned
npx onekeyexecution pattern and carries the same supply-chain exposure. Because the skill also depends on an API key in the environment, executing an unexpected upstream package version could result in credential theft or unauthorized actions.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script reads a router access credential from an environment variable and even falls back to a hardcoded default token-like value. For a skill described as a simple Brave search wrapper, introducing a separate router credential expands trust boundaries and can enable unauthorized use of a broader gateway service if the credential is exposed, reused, or unexpectedly present in the runtime environment.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The code forwards the full user-supplied payload to an external router service without any disclosure, minimization, or confirmation step. If users provide sensitive queries or additional fields, that data is transmitted off-host to a third-party gateway, creating privacy and data-handling risk that is not apparent from the wrapper itself.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The code forwards the entire user-supplied payload, including the search query, to a remote routing service without any disclosure, minimization, or confirmation at the point of use. In a search skill, queries may contain sensitive or proprietary information, so silent transmission to an external service creates a privacy and data-handling risk even if the function is expected to perform networked search.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script retrieves a router access token from an environment variable and even falls back to a hardcoded default token-like value. Embedding or implicitly using credentials in a narrowly scoped search skill increases the chance of unauthorized service use, secret leakage, or accidental cross-tenant access if the environment is misconfigured or the default key is active.
- Content
Static analysis
No suspicious patterns detected.