ClawHub
Back to skill

Security audit

Taizi Brave Search

Security checks for vulnerabilities and agentic risk

Overview

This search skill does what a web-search tool is expected to do, but it is under-disclosed because it scrapes Brave pages instead of using the advertised API and can fetch arbitrary URLs from the agent's network context.

Install only if you are comfortable with a skill that performs live web requests, scrapes Brave's public results page rather than using the advertised Brave API, and can fetch arbitrary URLs from the agent's network. Avoid using it with confidential search terms or URLs, and run it in an environment where outbound requests cannot reach private services or metadata endpoints.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
content.js:5
Finding

Unrestricted URL Fetching Enables Server-Side Request Forgery in content.js

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
search.js:106
Finding

Unvalidated Search Result Destinations Enable Indirect Server-Side Request Forgery

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (17)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Using website scraping instead of the declared Brave Search API changes the trust and security model: scraping often requires broader arbitrary HTTP fetching and may reach untrusted third-party content. Combined with undeclared permissions, this creates a larger-than-advertised attack surface and increases the chance of data exfiltration, unsafe content ingestion, or policy bypass.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

Using website scraping instead of the declared Brave Search API changes the trust and security model: scraping often requires broader arbitrary HTTP fetching and may reach untrusted third-party content. Combined with undeclared permissions, this creates a larger-than-advertised attack surface and increases the chance of data exfiltration, unsafe content ingestion, or policy bypass.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md
./search.js "query" # Basic search (5 results)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md
./search.js "query" # Basic search (5 results)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md
./search.js "query" # Basic search (5 results)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md
./search.js "query" # Basic search (5 results)

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High
Category
Supply Chain
Confidence
93% confidence
Finding

The lockfile pins jsdom's transitive dependency ws to version 8.19.0, and the supplied advisories indicate this version is affected by memory disclosure and memory-exhaustion denial of service issues. Even though this skill is a web search/content extraction tool and may not explicitly expose WebSocket features, bundling a known vulnerable library is still risky because jsdom can bring ws into reachable runtime paths or future code changes may use it unintentionally.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding

The skill documentation declares functionality that clearly requires outbound network access, but it does not declare any explicit tool scope or permissions. This weakens policy enforcement and reviewability, making it easier for a skill to perform external requests without clear operator awareness or least-privilege constraints.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The description says to use the skill for 'searching documentation, facts, or any web content.' The phrase 'any web content' is very broad and lacks constraints or negative examples, which could cause unintended invocation for general web-related requests.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill metadata claims Brave Search API usage, but the implementation actually scrapes Brave's public HTML results page using browser-like headers. This is a supply-chain trust and transparency issue: operators may approve the skill believing it uses a stable API with known terms, data handling, and rate controls, while it really depends on brittle scraping behavior that can bypass expectations and fail unpredictably.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill sends the user's search query to Brave and, with --content, fetches arbitrary third-party pages from returned links. This creates privacy and security exposure because user-supplied queries may contain sensitive internal terms, and content fetching expands network disclosure to external sites without explicit warning, allowlisting, or consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The request hard-codes an Accept-Language header of en-US,en;q=0.9, which imposes an English/US locale preference regardless of the user's actual language settings. This is a natural-language policy concern because the file does not offer a user choice or document a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 9)May include surrounding context.

json
"author": "Mario Zechner",
  "license": "MIT",
  "dependencies": {
    "@mozilla/readability": "^0.6.0",
    "jsdom": "^27.0.1",
    "turndown": "^7.2.2",
    "turndown-plugin-gfm": "^1.0.2"

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 10)May include surrounding context.

json
"license": "MIT",
  "dependencies": {
    "@mozilla/readability": "^0.6.0",
    "jsdom": "^27.0.1",
    "turndown": "^7.2.2",
    "turndown-plugin-gfm": "^1.0.2"
  }

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 11)May include surrounding context.

json
"dependencies": {
    "@mozilla/readability": "^0.6.0",
    "jsdom": "^27.0.1",
    "turndown": "^7.2.2",
    "turndown-plugin-gfm": "^1.0.2"
  }
}

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 12)May include surrounding context.

json
"@mozilla/readability": "^0.6.0",
    "jsdom": "^27.0.1",
    "turndown": "^7.2.2",
    "turndown-plugin-gfm": "^1.0.2"
  }
}

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

The code hard-codes Accept-Language to en-US,en;q=0.9, which imposes a specific language/locale preference in outbound requests. There is no option for the user to choose a different locale or any documented justification that this tool must be English-only.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.