Security audit

Brave Search

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Brave Search integration that includes broad Maton automation reference material, but I found no hidden execution, deception, or automatic data forwarding in the artifact.

Install only if you are comfortable using Maton as a managed gateway for Brave Search. Treat hosted functions, triggers, destinations, and --exec watching as advanced automation: approve them only when you understand what data will flow, where it will go, and how to delete the automation afterward.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill bundles broad Maton function-hosting and trigger automation guidance into what is presented as a Brave Search integration, materially widening the operational surface beyond simple search calls. Even though the text includes multiple safety caveats, embedding generic hosted-code deployment, trigger creation, and event-forwarding workflows in this skill can mislead agents into treating those capabilities as part of normal Brave Search usage, enabling persistent automation or code execution paths that are much higher risk than the core integration.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest and top-level description scope this skill to web, image, news, and video search, but the documented API surface quietly expands into local POI lookup, autosuggest, spellcheck, and multiple summarizer endpoints. That mismatch can cause an agent or reviewer to authorize or trust the skill under a narrower mental model than what it can actually access, increasing the risk of unintended data access, privacy-sensitive lookups, or use of higher-tier features without explicit user awareness.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest says this skill is for Brave Search web, image, news, and video search, and explicitly states Brave Search is not an event source. This file nonetheless documents HubSpot CRM event triggers such as contact, company, deal, and ticket lifecycle events, which are capabilities unrelated to Brave Search and could broaden the apparent functional scope of the skill.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.