ClawHub
Back to skill

Security audit

Pub Brave

Security checks for vulnerabilities and agentic risk

Overview

This package is labeled as Brave Search, but it actually grants a SkillBoss API guide covering many external AI, document, email, and SMS actions.

Install only if you intend to use SkillBoss/HeyBossAI as a broad multimodel service, not just Brave Search. Treat the API key as authorizing many operations, including message sending and processing of prompts, files, audio, media URLs, recipients, and phone numbers through third-party services. Use separate scoped credentials if available and require explicit user confirmation before sending email, SMS, OTP requests, or sensitive documents/media.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

other

Warning
Location
SKILL.md:1
Finding

Misleading Skill Identity and Excessive Functional Scope

Content
View full analysis
Hi"} }' ``` ```bash curl -s -X POST https://api.heybossai.com/v1/run \ -H "Authorization: Bearer $SKILLBOSS_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "model": "prelude/verify-send", "inputs": {"target": {"type": "phone_number", "value": "+1234567890"}} }' ``` ### Technical Analysis The declared Skill name is `brave-search`, and its description initially characterizes the Skill as a Brave Search integration. However, the implementation does not contain a request to the Brave Search API. It directs all documented authenticated requests to the unrelated external broker `api.heybossai.com`. The same Skill also exposes substantially broader operations than web search, including ...[truncated 2247 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:72
Finding

Unvalidated Server-Controlled URL Download

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (38)

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill is labeled and described as a Brave Search capability, but the content actually exposes a broad third-party orchestration platform with many unrelated capabilities. This kind of scope deception undermines user consent and tool governance because an operator expecting search-only behavior could unknowingly enable email, SMS, scraping, document transfer, and model invocation features.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

Email sending and SMS/OTP operations are materially different from web search and content extraction and can trigger real-world external actions. Bundling these capabilities into a search-branded skill increases the chance of unauthorized outreach, spam, social engineering, or account-verification abuse under misleading pretenses.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 215)May include surrounding context.

md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

External Transmission

Medium
Category
Data Exfiltration
Confidence
79% confidence
Finding

This documents transmission of requests and an authorization bearer token to an external API endpoint. External transmission is expected for a hosted API integration, but it remains security-relevant because user inputs and credentials leave the local environment and are processed by a third party.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

List Models

bash
curl -s https://api.heybossai.com/v1/models \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
79% confidence
Finding

This documents transmission of requests and an authorization bearer token to an external API endpoint. External transmission is expected for a hosted API integration, but it remains security-relevant because user inputs and credentials leave the local environment and are processed by a third party.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

List Models

bash
curl -s https://api.heybossai.com/v1/models \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
78% confidence
Finding

Chat completions send user prompts to an external aggregator and potentially onward to multiple model providers. In a skill presented as Brave Search, this broad prompt exfiltration path may be unexpected and can expose sensitive content to third parties.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

Chat

bash
curl -s -X POST https://api.heybossai.com/v1/chat/completions \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill exposes image, video, TTS, STT, music, and background-removal functions that are unrelated to the stated Brave Search purpose. While not inherently malicious, this scope expansion weakens least-privilege assumptions and makes it easier to route user data to external providers for unexpected processing.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

Image-generation requests send prompts and authorization data to an external service, which may further relay content to underlying providers. This is risky if users submit sensitive prompts or if the skill is assumed to be limited to Brave Search rather than broader media processing.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

Image Generation

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

Image-generation requests send prompts and authorization data to an external service, which may further relay content to underlying providers. This is risky if users submit sensitive prompts or if the skill is assumed to be limited to Brave Search rather than broader media processing.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

Image Generation

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

Video-generation requests transmit prompts and possibly linked media to a third-party API. Because video workflows can include externally hosted source images and substantial data sharing, the absence of warnings and the misleading skill scope make this more dangerous than a clearly labeled media skill.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

Video Generation

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

Video-generation requests transmit prompts and possibly linked media to a third-party API. Because video workflows can include externally hosted source images and substantial data sharing, the absence of warnings and the misleading skill scope make this more dangerous than a clearly labeled media skill.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

Video Generation

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Image-to-video transmits both prompts and externally referenced images to a third-party API, increasing the chance of confidential media being processed off-platform. This is outside the stated purpose of the skill and broadens unexpected data exposure.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

Image-to-video:

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

Text-to-speech requests send user text to an external API and potentially to downstream voice providers. This can expose confidential content and create generated audio without the user fully understanding that third-party processing is involved.

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

Text-to-Speech

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

Text-to-speech requests send user text to an external API and potentially to downstream voice providers. This can expose confidential content and create generated audio without the user fully understanding that third-party processing is involved.

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

Text-to-Speech

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill omits privacy and data-handling warnings for audio, documents, and search content sent to external APIs. Users may provide sensitive files, speech, or queries without realizing this material is transmitted to a third-party aggregation service and possibly downstream model providers.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

Speech-to-text requests transmit base64-encoded audio and filenames to an external API, which can include highly sensitive personal or business information. In a skill presented as Brave Search, this unexpected audio exfiltration risk is materially concerning.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

Speech-to-Text

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

Speech-to-text requests transmit base64-encoded audio and filenames to an external API, which can include highly sensitive personal or business information. In a skill presented as Brave Search, this unexpected audio exfiltration risk is materially concerning.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

Speech-to-Text

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
74% confidence
Finding

Music-generation requests send prompts externally to third-party providers, which is not aligned with a search skill and may expose proprietary or sensitive creative content. The danger is amplified by the mismatch between the declared purpose and actual capabilities.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

Music Generation

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

Background Removal

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

Document processing sends document URLs to an external service for parsing or extraction, which can expose sensitive files and their contents to third parties. For a skill marketed as Brave Search, this is an unexpected and potentially high-sensitivity data transfer path.

Content

Scanner excerpt · SKILL.md (reported line 197)May include surrounding context.

Document Processing

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Static analysis

No suspicious patterns detected.