ClawHub
Back to skill

Security audit

Agent Onboarding

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent Bright Data onboarding, but its install and credential steps place substantial trust in mutable external code and persistent agent-skill changes without enough safeguards.

Install only if you trust Bright Data and are comfortable with persistent CLI and agent-skill changes. Prefer a pinned, reviewable install path over curl-to-bash or unpinned npx/npm commands, inspect any skill bundle before it is placed in an active agent directory, avoid putting API keys in shell history or URL query strings, keep .env files out of version control, and rotate any key that may have been exposed.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:31
Finding

Remote Installer Is Downloaded and Executed Without Verification

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
SKILL.md:34
Finding

Unpinned Third-Party Packages Are Installed or Executed

Content
View full analysis
``` ```bash pip install brightdata-sdk ``` ### Technical Analysis The commands do not pin exact dependency versions or provide lockfiles, integrity hashes, or signature-verification instructions. They consequently resolve whatever package release the registry considers current when the command is run. The `npx --yes` variant is particularly sensitive because it permits retrieval and execution without an interactive confirmation step. A global npm installation also increases the duration and scope of the installed component. Depending on package-manager behavior and package metadata, installation lifecycle scripts or subsequently invoked package code may execute with the user's privileges. This does not by itself prove that the named packages are malicious. The vulnerability is that the instructions delegate executable content to mutable third-party registry state that was not part of the audited artifact. ### Attack Path 1. An attacker compromises a package publisher, registry account, release pipeline, or an upstream dependency. 2. A malicious or compromised package version is published under the expected package name. 3. A user follows one of the unpinned installation or execution commands. 4. The package manager resolves the compromised current release. 5. Installation lifecycle code or package runtime code executes under the user's account. 6. The malicious component accesses data and permissions available to that process or remains installed for later execution. ### Impact Assessment The maximum direct privilege is generally that of the invoking user. Potential exposure include ...[truncated 338 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
SKILL.md:84
Finding

Mutable Agent Skills Are Installed Into the Agent Instruction Directory

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:237
Finding

Bright Data API Token Is Embedded in an MCP URL Query String

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:53
Finding

API Keys May Be Exposed Through Command Arguments and Shell History

Content
View full analysis
``` ```bash echo "BRIGHTDATA_API_KEY=..." >> .env echo "BRIGHTDATA_UNLOCKER_ZONE=" >> .env ``` ### Technical Analysis Passing a literal API key as a command-line argument can expose it through shell history, terminal logging, process inspection, diagnostic collection, or command auditing. The degree of process visibility depends on the operating system and local security configuration, but shell-history exposure remains a common risk. Writing a literal key through `echo` also places it in shell history. The resulting `.env` file may have permissions inherited from the user's current umask and could be read by unintended local principals. It may also be accidentally committed to version control. Repeated append operations can leave duplicate or stale credentials in the file. The Skill also documents environment-variable authentication, which is more appropriate than literal arguments but still requires secure secret injection and prevention of accidental logging. ### Attack Path 1. A user replaces the placeholder with a real API key and runs the documented command. 2. The shell records the command, or a process-monitoring or terminal-logging facility captures it. 3. Alternatively, the user writes the key to `.env`, and that file receives permissive access, enters a backup, or is committed to a repository. 4. Another local user, repository reader, support operator, or attacker obtains the recorded key. 5. The key is replayed against Bright Data's authenticated API. 6. The attacker performs operations and consumes permissions or quota associated with the account. ### Impact Assessment The exposed credential may authorize Bright Data API requests, account-bound scraping operations, access to con ...[truncated 310 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

curl -fsSL https://cli.brightdata.com/install.sh | bash is a classic arbitrary-code-execution pattern. If the script source or delivery path is compromised, users will run attacker-controlled code immediately, making this especially dangerous in a skill intended for developer onboarding.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

bash
# macOS / Linux — fastest install
curl -fsSL https://cli.brightdata.com/install.sh | bash

# Cross-platform (or if you don't want the install script)
npm install -g @brightdata/cli

Chaining Abuse

High
Category
Tool Misuse
Confidence
96% confidence
Finding

The shell pipe chaining of downloaded content directly into bash removes opportunities for inspection and compounds the remote-script execution risk. In an onboarding skill, this increases the chance that users blindly execute unreviewed network-supplied code, making exploitation straightforward if the upstream content is tampered with.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

bash
# macOS / Linux — fastest install
curl -fsSL https://cli.brightdata.com/install.sh | bash

# Cross-platform (or if you don't want the install script)
npm install -g @brightdata/cli

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

The skill instructs users to append secrets directly into .env without warning about file permissions, accidental source control inclusion, local leakage, or secret scanning. In onboarding content, this is risky because users frequently copy such commands into repositories where .env may later be exposed.

Content

Scanner excerpt · SKILL.md (reported line 280)May include surrounding context.

  1. Save it where the rest of the app reads secrets:
bash
echo "BRIGHTDATA_API_KEY=..." >> .env
echo "BRIGHTDATA_UNLOCKER_ZONE=<zone-name>" >> .env

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

The zone value itself is less sensitive than the API key, but this finding is part of a credential-handling pattern that normalizes writing service configuration into local .env files without safeguards. In context, the dangerous part is the insecure secret-management guidance surrounding adjacent credentials.

Content

Scanner excerpt · SKILL.md (reported line 281)May include surrounding context.

bash
echo "BRIGHTDATA_API_KEY=..." >> .env
echo "BRIGHTDATA_UNLOCKER_ZONE=<zone-name>" >> .env

Verify

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 298)May include surrounding context.

md
## Path D — Use Bright Data without installing anything

Use this when the environment can't run `npm` / `curl | bash`, or
when you only need one or two requests and don't want the CLI / SDK.
Works for both live agent work and app integration.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs users to execute a remote script via curl ... | bash with no warning, review step, checksum, or signature verification. That pattern is dangerous because compromise of the remote host, CDN, or install script would immediately yield arbitrary code execution on the user's machine.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill encourages passing API keys via command line and environment configuration without warning about exposure in shell history, process listings, logs, or accidentally committed .env files. It also later places tokens in URL query parameters for MCP, which further increases leakage risk through logs and referrers.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 211)May include surrounding context.

bash
# Web Unlocker via REST
curl -sS https://api.brightdata.com/request \
  -H "Authorization: Bearer $BRIGHTDATA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 211)May include surrounding context.

bash
# Web Unlocker via REST
curl -sS https://api.brightdata.com/request \
  -H "Authorization: Bearer $BRIGHTDATA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{