Brave Api Setup

• Analyzed: May 12, 2026, 3:37 AM
• Findings: 1
• Version: 0.1.2
• Hash: 0ec02f9cbbc3b476906d371f6dc8c431664fc59f3c5a6052aca84a5faa71cd31
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill `brave-api-setup` is designed to automate the configuration of the Brave Search API key for OpenClaw. It uses the `browser` tool to navigate to the Brave API dashboard, extract the API key via JavaScript evaluation, and then uses a local Node.js script (`scripts/apply-api-key.js`) to write this key directly into the OpenClaw configuration file (`~/.openclaw/openclaw.json`). All actions are clearly aligned with the stated purpose, and there is no evidence of data exfiltration, malicious execution (beyond expected configuration updates), persistence mechanisms, or prompt injection attempts against the agent. The use of `browser(action="evaluate")` is for a specific, legitimate data extraction task from a trusted domain.