ClawHub
Back to skill

Security audit

brave-api-search

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Brave Search API integration that sends user queries to Brave and uses Brave API keys, with no evidence of hidden persistence, privilege escalation, destructive behavior, or unrelated data access.

Install only if you are comfortable sending search terms, questions, and optional search context to Brave's API under your Brave account. Keep API keys in environment variables or an uncommitted .env file, avoid submitting secrets or sensitive personal data as queries, and monitor Brave API quota/costs. Expect Brave Answers to use English internally, and treat the non-streaming citation/entity behavior as ambiguously documented.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (16)

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding

The code is narrowly focused on Brave AI Answers rather than general web search or autosuggest. It calls only the /chat/completions endpoint under the Brave API base URL, uses only BRAVE_ANSWERS_API_KEY, and formats streamed/non-streamed grounded answer output with citations and entities. There is no implementation of a search endpoint, autosuggest endpoint, or any use of BRAVE_SEARCH_API_KEY in the supplied code. While the declared description includes AI-powered grounded answers with citations, which does match this code, the broader declared purpose overstates the implemented capabilities in this chunk.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description says the skill performs real-time web search, autosuggest, and AI-grounded answers via the official Brave Search API and Brave Answers API. The supplied code does none of those primary functions. Instead, it exclusively calls the Brave spellcheck endpoint and formats correction suggestions. This is a materially different primary purpose and an undeclared capability relative to the description. While reuse of the Brave Search API ecosystem is related, the actual behavior is limited to spellchecking, so the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The code's actual function is narrowly scoped to autosuggest. It sends requests to Brave's suggest endpoint, formats suggestion results, and supports optional rich/entity display. There is no code for general search results retrieval, no call to an answers endpoint, and no citation/grounded-answer generation. While autosuggest is accurately represented as part of the description, the overall declared purpose overstates the implemented capabilities for this supplied chunk.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

Set your Brave API keys in a local .env file (recommended):

bash
# .env (do not commit)
BRAVE_SEARCH_API_KEY=your_key_here
BRAVE_ANSWERS_API_KEY=your_key_here
AUTOSUGGEST_API_KEY=your_key_here   # optional, for autosuggest only

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill documentation indicates the capability to access environment variables and make outbound network requests, but it does not declare an explicit tool scope such as permissions or allowed-tools. In an agent ecosystem, missing capability scoping increases the risk of overbroad execution and makes review and enforcement harder, especially because the skill is designed to handle API secrets and transmit user queries externally.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documentation first states that disabling streaming means citations and entity data will not be available, and that non-streaming loses citations and entity data. Later, the technical details claim non-streaming mode applies parseCitations() and parseEntities() so citations and entities are extracted even without streaming, which is a direct contradiction in the skill's stated behavior.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
60% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 225)May include surrounding context.

md
- This skill only calls Brave official endpoints under `https://api.search.brave.com/res/v1`.
- It requires `BRAVE_SEARCH_API_KEY` and `BRAVE_ANSWERS_API_KEY` (keep them in `.env`, not inline in commands/chats).
- Optionally accepts `AUTOSUGGEST_API_KEY` or `BRAVE_AUTOSUGGEST_API_KEY` for autosuggest.
- It does not request persistent/system privileges and does not modify system config.
- All scripts are Node.js 18+ native (no external dependencies).

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The request body hard-codes the language field to 'en', which imposes a specific locale regardless of user preference. This is a natural-language policy issue because the skill does not offer a language choice or explain why English is required.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill sends the user's query content to Brave's external chat/completions endpoint, which is a data-transmitting network operation. While the file comments mention the required API key, there is no user-facing prompt, log message, or warning that the query will be sent to a third-party service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The non-streaming request path also hard-codes the language field to 'en', again enforcing a specific locale without opt-in. Because this behavior exists in both execution paths, users cannot avoid the language restriction by changing modes.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest describes capabilities for search, autosuggest, and AI-grounded answers, but this code calls Brave's spellcheck endpoint and formats spelling corrections. Spellchecking is a distinct user-facing capability and is not an obvious implementation detail of search, autosuggest, or answers as described.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 222)May include surrounding context.

md
// Brave Autosuggest - uses Brave Search API suggest endpoint
// Requires: AUTOSUGGEST_API_KEY, BRAVE_AUTOSUGGEST_API_KEY, or BRAVE_SEARCH_API_KEY env var

const BASE_URL = 'https://api.search.brave.com/res/v1';
const { parseArgs, fetchWithRetry, createCache } = require('./utils');

// Shared cache: key = query+country+rich, TTL = 60s

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · brave_answers.js (reported line 8)May include surrounding context.

js
// Brave Autosuggest - uses Brave Search API suggest endpoint
// Requires: AUTOSUGGEST_API_KEY, BRAVE_AUTOSUGGEST_API_KEY, or BRAVE_SEARCH_API_KEY env var

const BASE_URL = 'https://api.search.brave.com/res/v1';
const { parseArgs, fetchWithRetry, createCache } = require('./utils');

// Shared cache: key = query+country+rich, TTL = 60s

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · brave_search.js (reported line 5)May include surrounding context.

js
// Brave Autosuggest - uses Brave Search API suggest endpoint
// Requires: AUTOSUGGEST_API_KEY, BRAVE_AUTOSUGGEST_API_KEY, or BRAVE_SEARCH_API_KEY env var

const BASE_URL = 'https://api.search.brave.com/res/v1';
const { parseArgs, fetchWithRetry, createCache } = require('./utils');

// Shared cache: key = query+country+rich, TTL = 60s

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · brave_spellcheck.js (reported line 5)May include surrounding context.

js
// Brave Autosuggest - uses Brave Search API suggest endpoint
// Requires: AUTOSUGGEST_API_KEY, BRAVE_AUTOSUGGEST_API_KEY, or BRAVE_SEARCH_API_KEY env var

const BASE_URL = 'https://api.search.brave.com/res/v1';
const { parseArgs, fetchWithRetry, createCache } = require('./utils');

// Shared cache: key = query+country+rich, TTL = 60s

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · brave_suggest.js (reported line 5)May include surrounding context.

js
// Brave Autosuggest - uses Brave Search API suggest endpoint
// Requires: AUTOSUGGEST_API_KEY, BRAVE_AUTOSUGGEST_API_KEY, or BRAVE_SEARCH_API_KEY env var

const BASE_URL = 'https://api.search.brave.com/res/v1';
const { parseArgs, fetchWithRetry, createCache } = require('./utils');

// Shared cache: key = query+country+rich, TTL = 60s