Security audit

Brightdata Cli

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Bright Data CLI guide, but it recommends high-impact unverified installers and floating package execution that users should review before installing.

Review this skill before installing. Prefer a pinned, verified Bright Data CLI installation method instead of curl-to-bash or floating npx commands, authenticate only on machines you trust, know that credentials may persist locally, and avoid sending secrets, private/internal URLs, or sensitive personal data through Bright Data unless you have authorization.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:16
Finding: Unverified Remote Installer Is Downloaded and Executed Directly
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:21
Finding: Unpinned npm and npx Commands Execute Mutable Third-Party Package Code
Content: View full analysis
``` ``` `references/commands.md:11-15`: ```bash # Any platform npm install -g @brightdata/cli # Without installing npx --yes --package @brightdata/cli brightdata ``` ### Technical Analysis The commands do not specify an exact package version. npm therefore resolves the package version available under the configured registry and distribution tag at execution time. The package selected in the future can differ from the one that existed when this Skill was audited. The global installation command can run npm lifecycle scripts and places executable code in the user’s global npm environment. The `npx --yes` variant automatically downloads and executes the resolved package without an interactive confirmation step. Consequently, compromise of the package publisher, npm account, registry delivery process, or a future package release could result in arbitrary local code execution. The package name uses the expected Bright Data namespace, and the reviewed files provide no evidence that the package is currently malicious. The risk arises from executing a floating, externally controlled dependency without version or integrity constraints. ### Attack Path 1. An attacker compromises the package publisher account, release process, or registry entry for `@brightdata/cli`. 2. The attacker publishes a malicious version or changes the version resolved by the relevant distribution tag. 3. A user or agent follows the documented unpinned `npm install` or `npx --yes` command. 4. npm downloads the attacker-controlled package. 5. Installation lifecycl ...[truncated 778 chars]
Remediation: View remediation
``` 2. Replace `X.Y.Z` with a verified release and update it only through a documented review process. 3. Prefer a project-local dependency governed by a committed lockfile when practical. 4. Use npm lockfile integrity metadata and trusted registry configuration. 5. Avoid `npx --yes` for floating or unreviewed package versions. 6. Consider disabling lifecycle scripts during installation if the package does not require them: ```bash npm install --global --ignore-scripts @brightdata/cli@X.Y.Z ``` 7. Verify first-party package provenance, publisher identity, release signatures, and registry metadata before recommending a version. 8. Document a controlled upgrade process that reviews release notes and package contents before changing the pinned version. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (16)

External Script Fetching

High

Category: Supply Chain
Confidence: 97% confidence
Finding: The documentation instructs users to fetch a remote script with curl and pipe it directly to bash, causing arbitrary code from the network to execute immediately without prior inspection. If the remote host, distribution channel, TLS trust chain, or script content is compromised, users may run attacker-controlled commands on their machine.
Content: Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.
macOS / Linux:

bash
curl -fsSL https://cli.brightdata.com/install.sh | bash

Windows or manual install (any platform):

Chaining Abuse

High

Category: Tool Misuse
Confidence: 96% confidence
Finding: Piping curl output directly into bash is a classic chaining-abuse pattern because it combines retrieval and execution into a single opaque step, preventing review of the downloaded content. In a skill intended for agent guidance, this is especially risky because users may copy-paste the command verbatim and execute arbitrary shell logic from an external source.
Content: Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.
macOS / Linux:

bash
curl -fsSL https://cli.brightdata.com/install.sh | bash

Windows or manual install (any platform):

External Script Fetching

High

Category: Supply Chain
Confidence: 95% confidence
Finding: The troubleshooting section repeats the remote-script installation pattern, reinforcing unsafe behavior and making accidental use more likely. Repetition in multiple sections increases the probability that users will adopt direct network-to-shell execution without scrutiny.
Content: Scanner excerpt · SKILL.md (reported line 280)May include surrounding context.
md
| Error | Fix | |-------|-----| | CLI not found | Install with `npm i -g @brightdata/cli` or `curl -fsSL https://cli.brightdata.com/install.sh \| bash` | | "No Web Unlocker zone specified" | `bdata config set default_zone_unlocker <zone>` or re-run `bdata login` | | "Invalid or expired API key" | `bdata login` | | "Access denied" | Check zone permissions in the Bright Data control panel |

External Script Fetching

High

Category: Supply Chain
Confidence: 97% confidence
Finding: curl -fsSL https://cli.brightdata.com/install.sh | bash fetches and executes an external script in one step, giving the remote source direct code execution on the host. In an agent skill context, this is especially risky because users may copy/paste trusted-looking setup commands without reviewing them.
Content: Scanner excerpt · references/commands.md (reported line 9)May include surrounding context.
bash
# macOS / Linux curl -fsSL https://cli.brightdata.com/install.sh | bash # Any platform npm install -g @brightdata/cli

Chaining Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: The | bash construct is a command-chaining pattern that directly passes remote content into a shell, magnifying the danger of any compromise in the fetched content. In a skill meant for terminal use, such patterns are more dangerous because they normalize opaque execution paths for users and downstream agents.
Content: Scanner excerpt · references/commands.md (reported line 9)May include surrounding context.
bash
# macOS / Linux curl -fsSL https://cli.brightdata.com/install.sh | bash # Any platform npm install -g @brightdata/cli

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/commands.md (reported line 45)May include surrounding context.
md
**What happens on login:** 1. Opens browser for OAuth (or uses device flow / direct API key) 2. Validates the API key 3. Saves credentials locally (`~/.config/brightdata-cli/credentials.json`) 4. Checks for required zones (`cli_unlocker`, `cli_browser`) 5. Creates missing zones automatically 6. Sets `cli_unlocker` as default zone if none configured

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/commands.md (reported line 280)May include surrounding context.
md
**What happens on login:** 1. Opens browser for OAuth (or uses device flow / direct API key) 2. Validates the API key 3. Saves credentials locally (`~/.config/brightdata-cli/credentials.json`) 4. Checks for required zones (`cli_unlocker`, `cli_browser`) 5. Creates missing zones automatically 6. Sets `cli_unlocker` as default zone if none configured

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 70% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/commands.md (reported line 242)May include surrounding context.

Flag Description
--skip-auth Skip the authentication step
-k, --api-key <key> Provide API key directly

bash

Flag	Description
`--skip-auth`	Skip the authentication step
`-k, --api-key <key>`	Provide API key directly

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger description is extremely broad, covering nearly any web scraping, search, or data collection request, which can cause the skill to activate in situations beyond the user's precise intent. Overbroad activation increases the chance that risky commands, credentialed workflows, or third-party tooling guidance are introduced unnecessarily into unrelated sessions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The skill recommends one-off execution via npx without pinning an exact package version, which allows whatever version is current at execution time to run. If the package is compromised upstream or a breaking/malicious release is published, users could execute unreviewed code directly on their system.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The login section states that the API key is saved locally and that setup becomes automatic, but it does not warn users where credentials are stored, how they are protected, or the implications on shared/multi-user systems. This can lead users to authenticate on insecure hosts or leave persistent credentials behind without understanding the exposure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documentation instructs users to pipe a remotely fetched script directly into bash without any warning or verification step. This is dangerous because it executes network-delivered code immediately, so any compromise of the hosting domain, transport, or script contents results in arbitrary code execution.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 86% confidence
Finding: Using npx --yes --package @brightdata/cli brightdata <command> without pinning an exact version allows whatever package version is current at execution time to run. This creates a supply-chain risk: a compromised maintainer account, malicious release, or breaking change could execute unexpected code on the user's machine.
Content: No source excerpt is available for this finding.

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
Content: Scanner excerpt · references/commands.md (reported line 242)May include surrounding context.

Flag Description
--skip-auth Skip the authentication step
-k, --api-key <key> Provide API key directly

bash

Flag	Description
`--skip-auth`	Skip the authentication step
`-k, --api-key <key>`	Provide API key directly

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation explains that pipeline commands trigger remote API requests and poll Bright Data endpoints, but it does not clearly warn that supplied URLs, search terms, names, and other parameters are transmitted to a third-party service. In a terminal-agent skill focused on scraping and data collection, this omission can cause users to unknowingly send sensitive targets, queries, or personal data off-host, creating privacy, confidentiality, and compliance risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: This markdown file includes a -o product.json example that writes output to disk, which can affect local user data. Under the markdown-specific warning criterion, there is no accompanying note about file creation or overwrite behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.