T09 · Insecure Skill Coding Practices
Error
- Location
content.js:7- Finding
Server-Side Request Forgery Through Unrestricted User-Supplied URL
- Content
View full analysis
- Remediation
View remediation
Security audit
Brave Search
Security checks for vulnerabilities and agentic risk
Overview
The skill performs useful web search and page extraction, but it misstates its Brave API use and allows broad, unrestricted network fetching from the agent environment.
Review before installing. Use only for non-sensitive public web searches and public URLs, preferably in an environment with network egress blocked to private networks and metadata services. Do not use it with confidential queries, internal links, or regulated data unless URL validation, redirect controls, clear data-flow documentation, and dependency updates are added.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
search.js:110- Finding
Server-Side Request Forgery Through Search Result Content Retrieval
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (16)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documented behavior claims Brave Search API-based search and extraction, while the detected behavior indicates direct URL fetching/content extraction and possibly no actual Brave API use. This mismatch can mislead users and orchestration systems about where data is sent and what controls apply, which is dangerous when remote fetching occurs under false assumptions.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./search.js "query" # Basic search (5 results)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./search.js "query" # Basic search (5 results)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./search.js "query" # Basic search (5 results)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./search.js "query" # Basic search (5 results)
Known Vulnerable Dependency: ws==8.18.3 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)
High
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
The lockfile pins jsdom's transitive dependency ws to version 8.18.3, and the supplied finding indicates that this exact version is affected by memory disclosure and memory-exhaustion DoS advisories. In a web search/content extraction skill that processes untrusted remote content, a vulnerable WebSocket library in the dependency tree increases exposure to attacker-controlled network input and can enable denial of service or data leakage if the code path is reached.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill advertises and instructs use of network-capable scripts, but the manifest does not declare any explicit tool scope or permission boundary. This creates a governance gap: an agent or reviewer cannot clearly see that the skill transmits user queries and fetches remote content, increasing the risk of unintended data egress and misuse.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The top-level description is broad enough to encourage invocation for almost any information-seeking task involving web content. Overbroad activation criteria can cause the skill to be selected unnecessarily, exposing user prompts, searches, or URLs to external services more often than intended.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill omits a clear warning that queries and URLs are sent to external services and that remote page content is fetched and processed. Users may unknowingly provide sensitive terms, internal links, or regulated data, leading to privacy, compliance, or data-leakage risks.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The catch-all phrase 'Any task requiring web search without interactive browsing' is an ambiguous activation condition that can trigger the skill in a wide range of contexts. That broad trigger increases the chance of unnecessary external requests and accidental disclosure of sensitive queries or target URLs.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The request header explicitly sets "Accept-Language" to "en-US,en;q=0.9", which imposes a specific language preference on every fetch. This is a natural-language/locale policy concern because the script does not provide an opt-in, override, or explanation for why English is required.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
The dependency uses a caret version range, which allows future compatible releases to be installed instead of a single fixed version. This increases supply-chain risk because a newly published compromised or breaking upstream release could be pulled into builds without an explicit review, though this package file alone does not indicate active exploitation.
- Content
json "author": "Mario Zechner", "license": "MIT", "dependencies": { "@mozilla/readability": "^0.6.0", "jsdom": "^27.0.1", "turndown": "^7.2.2", "turndown-plugin-gfm": "^1.0.2"
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
The jsdom dependency is specified with a caret range, permitting automatic adoption of later patch/minor releases. In a skill that processes untrusted web content, dependency drift can be more sensitive because parser/DOM libraries are security-relevant and a compromised or vulnerable upstream update could affect content handling.
- Content
json "license": "MIT", "dependencies": { "@mozilla/readability": "^0.6.0", "jsdom": "^27.0.1", "turndown": "^7.2.2", "turndown-plugin-gfm": "^1.0.2" }
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 92% confidence
- Finding
Using a caret range for turndown means builds may resolve to different package versions over time. That creates a low-severity but real supply-chain and reproducibility risk, since unreviewed upstream changes could alter behavior or introduce malicious code.
- Content
json "dependencies": { "@mozilla/readability": "^0.6.0", "jsdom": "^27.0.1", "turndown": "^7.2.2", "turndown-plugin-gfm": "^1.0.2" } }
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 92% confidence
- Finding
The turndown-plugin-gfm dependency is not pinned to a single immutable version, so future installs may pull newer releases automatically. This is a classic low-severity supply-chain hygiene issue that can enable accidental or malicious upstream changes to enter the environment without deliberate approval.
- Content
json "@mozilla/readability": "^0.6.0", "jsdom": "^27.0.1", "turndown": "^7.2.2", "turndown-plugin-gfm": "^1.0.2" } }
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The search request hard-codes an Accept-Language header of "en-US,en;q=0.9", which forces an English locale regardless of user preference. This is a natural-language/locale policy concern because the skill does not offer opt-in or document a justified region-specific constraint.
- Content
Static analysis
No suspicious patterns detected.