Security audit

Brave Search MCP Server

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Brave Search integration, but its install path runs mutable external npm/GitHub code and its privacy wording under-discloses that searches and locations go to Brave.

Review before installing. Prefer pinning the MCP package or Git commit, avoid npx auto-fetching latest on each run, run it with least privilege, and do not send sensitive searches or precise locations unless you are comfortable sharing them with Brave's API.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:34
Finding: Unpinned External Dependencies Are Downloaded and Executed
Content: View full analysis
Remediation: View remediation
"] ``` 2. Prefer installing the verified package in advance instead of allowing `npx -y` to download executable content when the MCP server starts. 3. Pin Git-based installation to a reviewed commit or cryptographically verified signed release tag: ```bash git clone https://github.com/brave/brave-search-mcp-server cd brave-search-mcp-server git checkout ``` 4. Use a committed lockfile and reproducible installation commands such as `npm ci` to prevent unexpected transitive dependency changes. 5. Verify package integrity using npm integrity metadata, release signatures, checksums, or an internal package mirror. 6. Review npm lifecycle scripts before installation. Where compatible with the package’s build process, disable unnecessary lifecycle scripts. 7. Run the MCP server under a dedicated, least-privileged account or sandbox with restricted filesystem and network access. 8. Expose only the required API key to the process, rotate it if compromise is suspected, and configure provider-side usage limits and monitoring. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill metadata and description are broad enough to make this tool eligible for many generic research, browsing, and fact-checking tasks, which increases the chance it is invoked automatically without an explicit user decision. Because this tool sends prompts and search terms to an external search provider, over-broad routing can cause unnecessary disclosure of user queries, including potentially sensitive topics or context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill emphasizes privacy benefits but does not clearly warn that user queries, news lookups, and especially location searches are transmitted to Brave's external API. This can mislead users or agents into treating the tool as locally private, resulting in unintentional sharing of sensitive search intent, personal interests, or location data with a third party.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.