ClawHub
Back to skill

Security audit

Agent Onboarding

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent Bright Data onboarding, but its install and credential steps place substantial trust in mutable external code and persistent agent-skill changes without enough safeguards.

Install only if you trust Bright Data and are comfortable with persistent CLI and agent-skill changes. Prefer a pinned, reviewable install path over curl-to-bash or unpinned npx/npm commands, inspect any skill bundle before it is placed in an active agent directory, avoid putting API keys in shell history or URL query strings, keep .env files out of version control, and rotate any key that may have been exposed.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:31
Finding
Remote Installer Is Downloaded and Executed Without Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 31 **Vulnerability Type**: Remote payload retrieval and immediate shell execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.brightdata.com/install.sh | bash ``` ### Technical Analysis The installation command streams a mutable response from an external server directly into Bash. It provides no opportunity to inspect the downloaded script and performs no version pinning, checksum verification, or cryptographic signature validation. TLS protects the connection in transit but does not establish that the current script is the same script that was reviewed. A compromise of the hosting service, publishing account, DNS infrastructure, or installer generation pipeline could therefore turn this documented command into arbitrary local code execution. This execution method exceeds the minimum privileges necessary for onboarding because the document already provides a package-manager installation alternative. The eventual privileges are those of the user running the command and could include administrative privileges if the user invokes the instructions from an elevated shell or if the remote installer requests elevation. ### Attack Path 1. An attacker compromises the installer endpoint, its deployment pipeline, or an account authorized to update the script. 2. The attacker changes `install.sh` to include malicious shell commands. 3. A user or automation agent follows the documented installation command. 4. `curl` retrieves the attacker-controlled response. 5. The pipe sends the response directly to Bash without integrity or content validation. 6. The payload executes with the invoking user's privileges and can access files, environment variables, credentials, and network resources available to that user. ### Impact Assessment Successful exploitation provides arbitrary command execution under the invoking account. This may permit theft or modification of projec ...[truncated 348 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Remove the direct `curl | bash` installation path. 2. Publish versioned, immutable installer artifacts. 3. Download the installer to a local file before execution so it can be inspected. 4. Publish a SHA-256 checksum through an independently protected channel, or preferably sign releases using a documented signing key. 5. Verify the checksum or signature before execution and abort on any mismatch. 6. Pin the installer or CLI to an explicitly reviewed release. 7. Run installation with ordinary user privileges unless a specific operation demonstrably requires elevation. 8. Prefer a locked package-manager workflow that supports integrity metadata and reproducible resolution. ]]>

T08 · Insecure Dependencies

Error
Location
SKILL.md:34
Finding
Unpinned Third-Party Packages Are Installed or Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 34-37 and line 180 **Vulnerability Type**: Unsafe dependency retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash # Cross-platform (or if you don't want the install script) npm install -g @brightdata/cli # One-off, no install npx --yes --package @brightdata/cli brightdata <command> ``` ```bash pip install brightdata-sdk ``` ### Technical Analysis The commands do not pin exact dependency versions or provide lockfiles, integrity hashes, or signature-verification instructions. They consequently resolve whatever package release the registry considers current when the command is run. The `npx --yes` variant is particularly sensitive because it permits retrieval and execution without an interactive confirmation step. A global npm installation also increases the duration and scope of the installed component. Depending on package-manager behavior and package metadata, installation lifecycle scripts or subsequently invoked package code may execute with the user's privileges. This does not by itself prove that the named packages are malicious. The vulnerability is that the instructions delegate executable content to mutable third-party registry state that was not part of the audited artifact. ### Attack Path 1. An attacker compromises a package publisher, registry account, release pipeline, or an upstream dependency. 2. A malicious or compromised package version is published under the expected package name. 3. A user follows one of the unpinned installation or execution commands. 4. The package manager resolves the compromised current release. 5. Installation lifecycle code or package runtime code executes under the user's account. 6. The malicious component accesses data and permissions available to that process or remains installed for later execution. ### Impact Assessment The maximum direct privilege is generally that of the invoking user. Potential exposure include ...[truncated 338 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Pin every package to an exact reviewed version, such as an exact semantic version rather than a floating tag. 2. Provide and enforce lockfiles with registry integrity metadata. 3. Publish checksums or signed provenance for distributed packages. 4. Avoid `npx --yes` for security-sensitive onboarding; require explicit review and confirmation before first execution. 5. Prefer project-local installation over global installation to reduce persistence and cross-project exposure. 6. Disable package lifecycle scripts where compatible with the package's documented installation process. 7. Use dependency scanning and verify publisher identity, release provenance, and transitive dependencies before updating pinned versions. 8. Execute package installation as an unprivileged user. ]]>

T08 · Insecure Dependencies

Error
Location
SKILL.md:84
Finding
Mutable Agent Skills Are Installed Into the Agent Instruction Directory<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 84-89 **Vulnerability Type**: Unverified installation of external agent instructions **Risk Level**: High ### Vulnerable Code ```bash # Interactive picker — choose skills + target agent bdata skill add # Install a specific skill bdata skill add scrape bdata skill add data-feeds bdata skill add competitive-intel ``` ### Technical Analysis These commands install additional Bright Data skills into a coding agent's skill directory. The document does not pin a skill bundle version or revision and does not require integrity or signature verification. The installed skill content is not included in the audited project, so its instructions and any associated scripts could not be assessed in this audit. Agent skill directories form part of the agent's instruction trust boundary. Installing mutable external content there can affect later tool selection, command generation, network activity, and handling of sensitive information. This is a supply-chain weakness even though the reviewed file does not itself contain instruction-hijacking text. ### Attack Path 1. An attacker compromises the skill distribution source, publishing account, CLI update channel, or a skill release. 2. The attacker modifies a skill bundle to contain unsafe instructions or references to unsafe executable content. 3. A user runs one of the documented `bdata skill add` commands. 4. The CLI retrieves and writes the mutable content into the agent's skill directory. 5. The agent loads the installed skill during a matching future task. 6. The unreviewed instructions influence agent behavior or cause additional commands and network operations within the permissions available to the agent. ### Impact Assessment The installed content may influence future agent sessions and any tools exposed to them. Depending on the host's agent configuration, this could expose source files, environment variables, local tools, authenticated servi ...[truncated 288 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Pin each skill to an immutable version, release digest, or source commit. 2. Cryptographically sign skill bundles and verify signatures before installation. 3. Download skills into a staging directory and display their complete contents for review before placing them in an active agent directory. 4. Require explicit user approval for the destination, requested files, and any executable components. 5. Maintain an allowlist of approved skill identifiers and verified release hashes. 6. Record the installed version and digest to support reproducible audits and rollback. 7. Prevent downloaded skills from modifying unrelated agent configuration or other skills. 8. Re-audit skill content before accepting any version update. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:237
Finding
Bright Data API Token Is Embedded in an MCP URL Query String<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 237 **Vulnerability Type**: Sensitive credential exposure through URL parameters **Risk Level**: High ### Vulnerable Code ```text https://mcp.brightdata.com/mcp?token=YOUR_BRIGHTDATA_API_TOKEN ``` ### Technical Analysis The MCP connection design places an API token in a URL query parameter. Full URLs are commonly retained by client configuration, browser history, reverse proxies, server access logs, observability platforms, debugging output, screenshots, and support bundles. HTTPS encrypts the URL while in transit but does not prevent either endpoint or local/intermediate software from recording it. Anyone who obtains a logged tokenized URL may be able to replay the bearer credential until it expires or is revoked. The endpoint is related to the Skill's declared Bright Data functionality, so the finding is insecure credential placement rather than evidence that the Skill sends the token to an unrelated recipient. ### Attack Path 1. A user replaces the placeholder with a real Bright Data API token. 2. The complete MCP URL is stored or processed by a client, proxy, server, monitoring system, or diagnostic tool. 3. One of those systems records the complete URL, including the query string. 4. An attacker or unauthorized operator obtains access to the history, logs, screenshot, configuration, or support bundle. 5. The attacker extracts and replays the token against the MCP service. 6. The attacker invokes the tools and consumes the account permissions or quota associated with that token. ### Impact Assessment Exposure can permit unauthorized access to the MCP tools enabled for the credential, including web search, scraping, structured-data operations, or browser-related capabilities described by the Skill. It may also consume paid account quota and expose data returned through the compromised account context. The exact account-level scope depends on the permissions assigned to the token ...[truncated 45 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Transmit the token through an `Authorization: Bearer` header rather than a URL query parameter. 2. If the MCP client has a dedicated protected secret field, use that field instead of embedding the credential in the endpoint. 3. Ensure clients, proxies, servers, and monitoring systems redact authorization material. 4. Avoid writing tokenized URLs to shell history, configuration files, screenshots, or diagnostic output. 5. Issue narrowly scoped, short-lived tokens where supported. 6. Provide immediate token rotation and revocation procedures. 7. Audit existing access logs and client configurations for previously exposed query-string tokens. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:53
Finding
API Keys May Be Exposed Through Command Arguments and Shell History<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 53 **Additional Location**: `SKILL.md`, line 274 **Vulnerability Type**: Unsafe local secret handling **Risk Level**: Medium ### Vulnerable Code ```bash bdata login --api-key <key> ``` ```bash echo "BRIGHTDATA_API_KEY=..." >> .env echo "BRIGHTDATA_UNLOCKER_ZONE=<zone-name>" >> .env ``` ### Technical Analysis Passing a literal API key as a command-line argument can expose it through shell history, terminal logging, process inspection, diagnostic collection, or command auditing. The degree of process visibility depends on the operating system and local security configuration, but shell-history exposure remains a common risk. Writing a literal key through `echo` also places it in shell history. The resulting `.env` file may have permissions inherited from the user's current umask and could be read by unintended local principals. It may also be accidentally committed to version control. Repeated append operations can leave duplicate or stale credentials in the file. The Skill also documents environment-variable authentication, which is more appropriate than literal arguments but still requires secure secret injection and prevention of accidental logging. ### Attack Path 1. A user replaces the placeholder with a real API key and runs the documented command. 2. The shell records the command, or a process-monitoring or terminal-logging facility captures it. 3. Alternatively, the user writes the key to `.env`, and that file receives permissive access, enters a backup, or is committed to a repository. 4. Another local user, repository reader, support operator, or attacker obtains the recorded key. 5. The key is replayed against Bright Data's authenticated API. 6. The attacker performs operations and consumes permissions or quota associated with the account. ### Impact Assessment The exposed credential may authorize Bright Data API requests, account-bound scraping operations, access to con ...[truncated 310 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Do not accept long-lived secrets as ordinary command-line arguments. 2. Read API keys from hidden interactive input, standard input, an operating-system credential store, or a dedicated secret-management service. 3. Configure the CLI to avoid printing, logging, or persisting the key in plaintext. 4. If a local environment file is necessary, create it without placing the secret in shell history and set restrictive permissions, such as owner read/write only. 5. Ensure `.env` is excluded from version control and secret-scan repositories and build artifacts. 6. Replace append-based configuration with a tool that safely updates a single key and avoids duplicate stale values. 7. Use narrowly scoped, short-lived credentials where supported, and document rotation and revocation procedures. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

External Script Fetching

High
Category
Supply Chain
Content
```bash
# macOS / Linux — fastest install
curl -fsSL https://cli.brightdata.com/install.sh | bash

# Cross-platform (or if you don't want the install script)
npm install -g @brightdata/cli
Confidence
98% confidence
Finding
`curl -fsSL https://cli.brightdata.com/install.sh | bash` is a classic arbitrary-code-execution pattern. If the script source or delivery path is compromised, users will run attacker-controlled code immediately, making this especially dangerous in a skill intended for developer onboarding.

Chaining Abuse

High
Category
Tool Misuse
Content
```bash
# macOS / Linux — fastest install
curl -fsSL https://cli.brightdata.com/install.sh | bash

# Cross-platform (or if you don't want the install script)
npm install -g @brightdata/cli
Confidence
96% confidence
Finding
The shell pipe chaining of downloaded content directly into `bash` removes opportunities for inspection and compounds the remote-script execution risk. In an onboarding skill, this increases the chance that users blindly execute unreviewed network-supplied code, making exploitation straightforward if the upstream content is tampered with.

Credential Access

High
Category
Privilege Escalation
Content
4. Save it where the rest of the app reads secrets:

```bash
echo "BRIGHTDATA_API_KEY=..." >> .env
echo "BRIGHTDATA_UNLOCKER_ZONE=<zone-name>" >> .env
```
Confidence
90% confidence
Finding
The skill instructs users to append secrets directly into `.env` without warning about file permissions, accidental source control inclusion, local leakage, or secret scanning. In onboarding content, this is risky because users frequently copy such commands into repositories where `.env` may later be exposed.

Credential Access

High
Category
Privilege Escalation
Content
```bash
echo "BRIGHTDATA_API_KEY=..." >> .env
echo "BRIGHTDATA_UNLOCKER_ZONE=<zone-name>" >> .env
```

### Verify
Confidence
90% confidence
Finding
The zone value itself is less sensitive than the API key, but this finding is part of a credential-handling pattern that normalizes writing service configuration into local `.env` files without safeguards. In context, the dangerous part is the insecure secret-management guidance surrounding adjacent credentials.

External Script Fetching

High
Category
Supply Chain
Content
## Path D — Use Bright Data without installing anything

Use this when the environment can't run `npm` / `curl | bash`, or
when you only need one or two requests and don't want the CLI / SDK.
Works for both live agent work and app integration.
Confidence
90% confidence
Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill instructs users to execute a remote script via `curl ... | bash` with no warning, review step, checksum, or signature verification. That pattern is dangerous because compromise of the remote host, CDN, or install script would immediately yield arbitrary code execution on the user's machine.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill encourages passing API keys via command line and environment configuration without warning about exposure in shell history, process listings, logs, or accidentally committed `.env` files. It also later places tokens in URL query parameters for MCP, which further increases leakage risk through logs and referrers.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Web Unlocker via REST
curl -sS https://api.brightdata.com/request \
  -H "Authorization: Bearer $BRIGHTDATA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Web Unlocker via REST
curl -sS https://api.brightdata.com/request \
  -H "Authorization: Bearer $BRIGHTDATA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.