Search
Analysis
This skill is mostly consistent with Bright Data web search, but it under-declares its required CLI and credential use while relying on shell automation and cross-skill handoffs.
Findings (8)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
For structured data from a known platform ... stop and use `data-feeds` instead.
The skill can halt or redirect the agent to another skill based on task type. This is disclosed and purpose-aligned, but it changes the agent's path from direct search.
xargs -a urls.txt -n 1 -P 4 -I {} bash -c ' ... bdata scrape "$url" -f markdown -o "out/${hash}.md"'The reference pattern chains search results into parallel scraping through shell commands. This is relevant to the search-to-scrape workflow, but it can amplify a broad or poor-quality URL list.
bdata CLI not installed — see bright-data-best-practices/references/cli-setup.md ... Halt and route to `skills/bright-data-best-practices/references/cli-setup.md` if either check fails.
The skill depends on an external CLI and setup guide, but the artifact set provides no install spec and the referenced setup file is not in the manifest.
xargs -a urls.txt -n 1 -P 4 -I {} bash -c 'The skill includes shell execution patterns. They are tied to search/scrape workflows, but still execute local shell commands.
while IFS= read -r q; do ... bdata search "$q" --engine google --country us --json ... done < queries.txt
The skill supports batch queries that can generate many result files and URL lists. The examples include deduplication and filtering, which helps contain the risk.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
echo "bdata not authenticated — run: bdata login (or: bdata login --device for SSH)"
The skill explicitly requires Bright Data account authentication, while the registry metadata declares no primary credential or required environment variables.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
Find recent articles on a topic, with body content in one call, ready to feed into an LLM:
The skill can retrieve untrusted webpage bodies and suggests feeding them into an LLM, which can expose the agent to prompt-injection or misleading page content.
Hands off to `scrape` once target URLs are chosen, and to `data-feeds` when the user wants structured data from a known platform.
The skill explicitly passes work to other skills. This is disclosed and aligned with the workflow, but data boundaries and permissions for those other skills are not defined here.