ClawHub
Back to skill

Security audit

Brave Search

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward web search and page-content extraction skill, with expected external network use and no evidence of hidden persistence, credential theft, or destructive behavior.

Install only if you are comfortable sending search terms to Brave Search and fetched URLs to destination websites. Do not use it for secrets, private internal URLs, confidential project names, or sensitive personal data. Be aware that the current implementation does not actually use the documented BRAVE_API_KEY.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill documentation declares no permissions while the described behavior clearly requires outbound network access for web search and URL fetching. This is dangerous because it hides the true capability surface from reviewers and users, making it easier to approve or invoke a skill that can exfiltrate data or access untrusted remote content without explicit disclosure.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The skill claims to use the Brave Search API, but the analyzed behavior indicates it also scrapes Brave's public web interface and fetches arbitrary user-supplied URLs for content extraction. That mismatch is dangerous because it conceals materially broader and riskier behavior than advertised, including unrestricted network retrieval from untrusted sites, which can bypass policy expectations and increase exposure to SSRF-style misuse, data exfiltration, and ingestion of malicious content.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"author": "Mario Zechner",
	"license": "MIT",
	"dependencies": {
		"@mozilla/readability": "^0.6.0",
		"jsdom": "^27.0.1",
		"turndown": "^7.2.2",
		"turndown-plugin-gfm": "^1.0.2"
Confidence
92% confidence
Finding
The dependency uses a caret range instead of an exact version, which allows future installs to resolve to newer package releases than the author originally tested. This increases supply-chain risk because a compromised or breaking upstream release could be pulled in automatically, especially in a skill that fetches and processes untrusted web content.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"license": "MIT",
	"dependencies": {
		"@mozilla/readability": "^0.6.0",
		"jsdom": "^27.0.1",
		"turndown": "^7.2.2",
		"turndown-plugin-gfm": "^1.0.2"
	}
Confidence
95% confidence
Finding
The jsdom dependency is not pinned exactly, so installs may pick up newer semver-compatible releases automatically. Because jsdom parses untrusted HTML/content in a web-search and extraction skill, any malicious or vulnerable upstream update could have more serious consequences than a typical library drift issue.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"dependencies": {
		"@mozilla/readability": "^0.6.0",
		"jsdom": "^27.0.1",
		"turndown": "^7.2.2",
		"turndown-plugin-gfm": "^1.0.2"
	}
}
Confidence
91% confidence
Finding
Using a caret range for turndown permits automatic resolution to later patch/minor versions, which can introduce unreviewed code into builds. While this package is lower risk than an HTML parser/runtime component, it still contributes to supply-chain exposure in a tool that transforms externally sourced content.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"@mozilla/readability": "^0.6.0",
		"jsdom": "^27.0.1",
		"turndown": "^7.2.2",
		"turndown-plugin-gfm": "^1.0.2"
	}
}
Confidence
90% confidence
Finding
The plugin dependency is specified with a caret range, allowing future installs to consume newer upstream code without explicit review. Even small utility packages can become supply-chain entry points if compromised, so this remains a real but low-severity weakness.

Static analysis

No suspicious patterns detected.