Brave Api Search 3.0.2

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:35 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent Brave Search integration, but its tool command templates may allow crafted search text to run local commands in shell-based runtimes.

Review before installing. Use it only with a runtime that passes tool arguments without shell interpretation or after the command templates are changed to argument-array execution. Treat all searches as third-party Brave API requests, keep Brave keys scoped to this service, and avoid submitting secrets or sensitive personal/company data.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: skill.json:18

Finding

Shell Command Injection Through Unsafely Interpolated Tool Arguments

Content

View full analysis

/tmp/skill-injection-test ; # ``` can produce a command structurally equivalent to: ```sh node ... --query "" ; printf injected > /tmp/skill-injection-test ; #" ``` The shell would execute the appended command independently of the intended Node.js script. Other templated arguments are also inserted without explicit shell escaping, although their declared numeric, boolean, or enumerated types may reduce exploitability if the framework strictly enforces those schemas. The JavaScript argument parsers do not cause this vulnerability because shell interpretation occurs before Node.js receives `process.argv`. Validation inside the scripts therefore cannot prevent injected shell commands from run ...[truncated 2030 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the implementation only performs autosuggest while advertising web search and AI-grounded answers, users may trust the skill for capabilities it does not have and route queries or credentials under false assumptions. Misrepresentation of external behavior is a security-relevant transparency problem even if it is not an exploit by itself.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

If the implementation only performs autosuggest while advertising web search and AI-grounded answers, users may trust the skill for capabilities it does not have and route queries or credentials under false assumptions. Misrepresentation of external behavior is a security-relevant transparency problem even if it is not an exploit by itself.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

If the implementation only performs autosuggest while advertising web search and AI-grounded answers, users may trust the skill for capabilities it does not have and route queries or credentials under false assumptions. Misrepresentation of external behavior is a security-relevant transparency problem even if it is not an exploit by itself.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

Set your Brave API keys in a local .env file (recommended):

bash

# .env (do not commit)
BRAVE_SEARCH_API_KEY=your_key_here
BRAVE_ANSWERS_API_KEY=your_key_here

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.

md

- This skill only calls Brave official endpoints under `https://api.search.brave.com/res/v1`.
- It requires exactly two env vars: `BRAVE_SEARCH_API_KEY` and `BRAVE_ANSWERS_API_KEY` (keep them in `.env`, not inline in commands/chats).
- It does not request persistent/system privileges and does not modify system config.
- It is source-file based (three local Node scripts), with no external install/download step.

## API vs Web Scraping

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The request body hard-codes language: 'en', which imposes a specific language regardless of the user's preference or locale. This is a natural-language policy concern because the skill does not offer a language choice or explain why English is required.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest describes three capabilities: web search, autosuggest, and AI-powered answers requiring both BRAVE_SEARCH_API_KEY and BRAVE_ANSWERS_API_KEY. In this file, the code only reads BRAVE_SEARCH_API_KEY and calls /web/search and /summarizer/search; there is no autosuggest implementation and no use of BRAVE_ANSWERS_API_KEY or a dedicated answers endpoint.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.

md

// Brave Autosuggest - uses Brave Search API suggest endpoint
// Requires: BRAVE_SEARCH_API_KEY env var

const BASE_URL = 'https://api.search.brave.com/res/v1';

function parseArgs(argv) {
  const args = {};

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · brave_answers.js (reported line 5)May include surrounding context.

js

// Brave Autosuggest - uses Brave Search API suggest endpoint
// Requires: BRAVE_SEARCH_API_KEY env var

const BASE_URL = 'https://api.search.brave.com/res/v1';

function parseArgs(argv) {
  const args = {};

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · brave_search.js (reported line 5)May include surrounding context.

js

// Brave Autosuggest - uses Brave Search API suggest endpoint
// Requires: BRAVE_SEARCH_API_KEY env var

const BASE_URL = 'https://api.search.brave.com/res/v1';

function parseArgs(argv) {
  const args = {};

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · brave_suggest.js (reported line 5)May include surrounding context.

js

// Brave Autosuggest - uses Brave Search API suggest endpoint
// Requires: BRAVE_SEARCH_API_KEY env var

const BASE_URL = 'https://api.search.brave.com/res/v1';

function parseArgs(argv) {
  const args = {};

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest explicitly states that user queries are sent to Brave Search and Answers APIs, but it provides no user-facing warning or consent mechanism about third-party data sharing. In a search skill, queries may contain sensitive research topics, personal data, or proprietary information, so silent transmission to an external provider creates a real privacy risk even if it is functionally necessary.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The tool defaults the country parameter to "us" for search and answers, and "US" for suggestions, which applies a specific locale automatically. This is a natural-language policy concern because the skill does not indicate user choice, opt-in, or a documented reason for forcing that locale.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: brave_answers.js:50

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: brave_search.js:21

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: brave_suggest.js:20