Brave Search CLI (bx)

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:32 AM UTC
• Version: 1.4.0

Overview

This Brave Search skill is for a real search workflow, but it broadly redirects searches through a local third-party executable and documents unsafe remote-script installation commands.

Review this skill before installing. Use bx only for queries you intend to send to Brave Search, avoid sending secrets or private code in search prompts, and do not run the documented pipe-to-shell or Invoke-Expression install commands. Prefer a verified, pinned release with checksums or signatures, and keep the built-in search tool available unless you intentionally choose Brave for the task.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:76

Finding

Mutable Remote Installation Scripts Are Downloaded and Executed Without Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 76-81
Vulnerability Type: Remote payload retrieval and immediate shell execution
Risk Level: High

Vulnerable Code

bash

curl -fsSL https://raw.githubusercontent.com/brave/brave-search-cli/main/scripts/install.sh | sh

powershell

powershell -ExecutionPolicy Bypass -c "irm https://raw.githubusercontent.com/brave/brave-search-cli/main/scripts/install.ps1 | iex"

Technical Analysis

Both installation commands retrieve scripts from the mutable main branch of an external GitHub repository and execute the responses immediately. The downloaded content is not pinned to a commit, saved for inspection, checked against a cryptographic hash, or verified using a digital signature.

The PowerShell variant additionally invokes ExecutionPolicy Bypass, deliberately disabling a local execution-policy safeguard for the process. HTTPS protects data in transit but does not protect against compromise of the upstream repository, maintainer account, branch, release process, or served content.

This behavior is not necessary for the Skill's web-search functionality. A versioned, integrity-verified binary installation would provide the required bx executable without granting mutable remote content an immediate shell execution channel.

Attack Path

1. An attacker compromises the upstream repository, a maintainer account, or the remote installation script.
2. The attacker inserts arbitrary shell or PowerShell commands into the script served from the main branch.
3. A user or agent follows the documented Quick Start command.
4. curl or Invoke-RestMethod retrieves the attacker-controlled response.
5. sh or Invoke-Expression executes that response without an inspection or integrity-verification boundary.
6. The payload operates with all permissions held by the invoking user and may install further components, access credentials, modify file ...[truncated 665 chars]

Remediation

View remediation

Remediation Suggestions

• Remove all pipe-to-shell and Invoke-Expression installation instructions.
• Do not use ExecutionPolicy Bypass.
• Download an immutable, versioned release asset to a local file before execution.
• Publish and verify a separate SHA-256 checksum for every supported platform.
• Prefer cryptographic release signatures with a documented, independently distributed verification key.
• Fail closed if checksum or signature verification fails.
• Pin scripts to a reviewed commit if scripts must be used, although signed release binaries are preferable.
• Display the downloaded script for inspection and require explicit user confirmation before execution.
• Run installation with ordinary user privileges and avoid recommending administrator or root execution.

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:66

Finding

Skill Globally Redirects Web Searches to an External Executable

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 66
Vulnerability Type: Agent instruction and tool-selection hijacking
Risk Level: High

Vulnerable Code

text

**When this skill is active, use `bx` via `exec` for all web searches. Do not use the built-in `web_search` tool.** Run `bx context "query"` as the default — it returns pre-extracted, token-budgeted content ready for use. Fall back to `bx answers` for synthesized explanations or `bx web` when search operators are needed.

Technical Analysis

The Skill does not merely explain how to use bx; it issues a mandatory agent directive that overrides tool selection for all web searches and explicitly prohibits the built-in search tool. The broad Skill description also encourages activation for general informational requests, increasing the directive's effective scope.

This changes the agent's session behavior and routes search terms through a locally executed third-party binary and the associated external service. It also removes the built-in tool as a safer or policy-controlled alternative. Consequently, any compromise of the downloaded executable or its installation chain affects every search conducted while the Skill is active.

Mandatory global redirection exceeds the minimum behavior needed to expose Brave Search as an optional capability. The Skill could provide bx only for explicit Brave Search requests or when the user selects that provider.

Attack Path

1. The Skill is loaded for a search-related request.
2. Its directive instructs the agent to ignore the built-in web_search capability.
3. The agent invokes bx through local process execution for every web search.
4. Queries and related metadata cross the external CLI and Brave Search API trust boundaries.
5. If the binary or installation supply chain is compromised, the attacker receives a repeated execution opportunity and may observe queries, access process-visible data, o ...[truncated 638 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the mandatory directive with optional, task-scoped guidance.
• Do not prohibit the built-in web_search tool.
• Invoke bx only when the user explicitly requests Brave Search or when a documented policy selects it.
• Preserve user consent and platform-level tool-selection controls.
• Clearly disclose that queries are sent to Brave's external API.
• Restrict local execution to the minimum required command and arguments.
• Treat search result content as untrusted input and ensure it cannot override agent instructions.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Platform Executables Are Downloaded Without Cryptographic Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16-55
Vulnerability Type: Unverified third-party executable dependency
Risk Level: Medium

Vulnerable Code

json

"install": [
  {
    "id": "download-linux-amd64",
    "kind": "download",
    "os": ["linux"],
    "bins": ["bx"],
    "label": "Install Brave Search CLI (GitHub)",
    "url": "https://github.com/brave/brave-search-cli/releases/download/v1.4.0/bx-1.4.0-linux-amd64"
  },
  {
    "id": "download-linux-arm64",
    "kind": "download",
    "os": ["linux"],
    "bins": ["bx"],
    "label": "Install Brave Search CLI (GitHub)",
    "url": "https://github.com/brave/brave-search-cli/releases/download/v1.4.0/bx-1.4.0-linux-arm64"
  },
  {
    "id": "download-darwin-arm64",
    "kind": "download",
    "os": ["darwin"],
    "bins": ["bx"],
    "label": "Install Brave Search CLI (GitHub)",
    "url": "https://github.com/brave/brave-search-cli/releases/download/v1.4.0/bx-1.4.0-darwin-arm64"
  },
  {
    "id": "download-windows-amd64",
    "kind": "download",
    "os": ["win32"],
    "bins": ["bx"],
    "label": "Install Brave Search CLI (GitHub)",
    "url": "https://github.com/brave/brave-search-cli/releases/download/v1.4.0/bx-1.4.0-windows-amd64.exe"
  },
  {
    "id": "download-windows-arm64",
    "kind": "download",
    "os": ["win32"],
    "bins": ["bx"],
    "label": "Install Brave Search CLI (GitHub)",
    "url": "https://github.com/brave/brave-search-cli/releases/download/v1.4.0/bx-1.4.0-windows-arm64.exe"
  }
]

Technical Analysis

The metadata identifies versioned GitHub release assets for five operating-system and architecture combinations. Versioned assets under the apparently matching Brave organization are safer than mutable branch content, but the Skill supplies no expected hashes, signature metadata, signer identity, or verification procedure.

As a result, the inst ...[truncated 1724 chars]

Remediation

View remediation

Remediation Suggestions

• Add a pinned SHA-256 digest for every operating-system and architecture-specific artifact.
• Verify the digest before marking the downloaded file executable or invoking it.
• Prefer signed releases and validate signatures against a documented trusted public key.
• Store integrity metadata in the reviewed Skill package or another independently controlled channel.
• Fail installation if the platform, version, checksum, or signer does not exactly match.
• Document a secure manual-verification workflow for users.
• Consider installation through a trusted package manager that supports signed metadata and reproducible provenance.
• Update version references and integrity values through a reviewed change rather than automatically tracking mutable upstream content.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description contains very broad activation phrases such as 'find', 'what is', and 'how do I', which can cause this skill to activate for a large portion of ordinary user requests. In this skill's context, over-broad routing is risky because it pushes potentially sensitive prompts to an external search CLI/service by default and overrides safer built-in alternatives.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The use of shell piping into 'sh' is a classic chaining-abuse pattern because untrusted network content is streamed directly into an interpreter without review. In an agent skill, this is more dangerous than a generic documentation example because the skill encourages operational execution behavior and may normalize unsafe command patterns for automated environments.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

macOS/Linux

bash

curl -fsSL https://raw.githubusercontent.com/brave/brave-search-cli/main/scripts/install.sh | sh

Windows (PowerShell)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill strongly directs agents to use an external search service for many requests, but it does not clearly warn that user queries will be transmitted to Brave Search and may contain secrets, proprietary code, internal URLs, or personal data. Because the skill is intended for broad use including debugging and research, accidental exfiltration of sensitive prompts is a realistic risk.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The Quick Start instructs users to fetch and execute a remote script directly from the network using 'curl ... | sh'. This is dangerous because it executes unpinned remote content immediately, enabling supply-chain compromise or server-side tampering to result in arbitrary code execution on the host.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

macOS/Linux

bash

curl -fsSL https://raw.githubusercontent.com/brave/brave-search-cli/main/scripts/install.sh | sh

Windows (PowerShell)

Static analysis

No suspicious patterns detected.