Brave Web Search

• Risk level: Low
• Analyzed: May 10, 2026, 6:37 AM
• Findings: 1
• Version: 1.0.1

Overview

This skill is a straightforward Brave Search integration that sends user queries to Brave using the expected API keys and shows no evidence of hidden local access, persistence, or unrelated behavior.

This appears safe for its stated purpose. Before installing, make sure you have legitimate Brave Search and Answers API keys and remember that any query you ask it to search will be sent to Brave's API.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI03: Identity and Privilege Abuse

Note

What this means

Your Brave API credentials will be used when the agent performs searches or answer lookups, and your query text is sent to Brave.

Why it was flagged

The code uses Brave API keys from the environment as subscription tokens for Brave API requests, which is expected for this search integration.

Skill content

headers: { ...baseHeaders, 'X-Subscription-Token': apiKey }

Recommendation

Install only if you are comfortable providing Brave API keys and sending search queries to Brave; avoid using it for queries containing secrets or private data.