ClawHub
Back to skill

Security audit

Python Sdk Best Practices

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent Bright Data SDK guide, but it under-warns about account-changing actions, third-party data transmission, and unpinned package installation.

Install only if you are comfortable using Bright Data services for the target sites and data involved. Keep API tokens and browser credentials out of logs and code, use a virtual environment, consider pinning `brightdata-sdk`, choose approved output paths for exports, and require explicit confirmation before creating or deleting Bright Data zones.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:13
Finding

Unpinned Third-Party SDK Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:13
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

bash
pip install brightdata-sdk

Technical Analysis

The Skill instructs users or agents to install brightdata-sdk from pip without specifying a reviewed version, package hash, lockfile, constraints file, or verified package source. Consequently, the installed code may differ from the version assessed when this Skill was audited.

Python package installation can execute package-controlled build or installation logic. The installed package also executes code when imported. If the package distribution or its publishing account is compromised, or a future release becomes malicious, following this instruction could introduce attacker-controlled code into the environment.

The audit did not find evidence that the named package is currently malicious. The issue is the absence of controls ensuring that installation resolves to a known and reviewed artifact.

Attack Path

  1. An attacker compromises the package publisher, distribution account, package index, or release process.
  2. The attacker publishes a malicious or compromised version under the expected package name.
  3. A user or coding agent follows SKILL.md:13.
  4. pip resolves the latest version available from its configured index.
  5. Malicious package logic executes during installation, import, or SDK use.
  6. The package operates with the privileges of the installing or executing process and can access resources available to that process.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the user's process privileges. Depending on the environment, exposed resources could include project files, environment variables, the documented BRIGHTDATA_API_TOKEN, Browser API credentials, network access, and Bright Data account capabilities authorized by those credentials.

The impact is limited by the priv ...[truncated 211 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to a reviewed exact version, for example:

    bash
    python -m pip install brightdata-sdk==<reviewed-version>

  2. Record and verify distribution hashes using a requirements file and --require-hashes.

  3. Provide a lockfile or constraints file covering both direct and transitive dependencies.

  4. Identify the official package index page and source repository so users can verify provenance.

  5. Install in an isolated virtual environment or container under a non-privileged account.

  6. Avoid exposing unrelated secrets to the installation and runtime process.

  7. Review new SDK versions before updating the pin, including package ownership, release provenance, dependency changes, and published artifacts.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md
async with BrightDataClient(token="your_token") as client:
    ...

# Option 3: .env file (requires python-dotenv)
# BRIGHTDATA_API_TOKEN=your_token
async with BrightDataClient() as client:
    ...

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api-reference.md (reported line 287)May include surrounding context.

md
async with BrightDataClient(token="your_token") as client:
    ...

# Option 3: .env file (requires python-dotenv)
# BRIGHTDATA_API_TOKEN=your_token
async with BrightDataClient() as client:
    ...

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The description says to "Always use this skill" when writing, modifying, debugging, or reviewing any Python code using Bright Data, and also whenever a user asks to scrape websites, search engines, access datasets, or automate browsers via Bright Data in Python. While domain-specific, this is still an expansive activation condition and does not provide exclusion conditions or negative examples to clarify when the skill should not activate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill documents exporting results to files and deleting zones without any warning that these actions write local data or irreversibly modify remote resources. In an agent setting, this increases the chance of unintended destructive actions or persistence of sensitive scraped data without explicit user consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The browser automation and scraping examples send target URLs, prompts, and retrieved content to an external service, but the skill gives no privacy, consent, or data-handling warning. In agent use, this omission can lead to accidental transmission of sensitive browsing targets or collected content to third-party infrastructure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file documents a delete_zone(zone_name) capability, which is a destructive operation affecting account configuration. The surrounding documentation provides no warning, confirmation note, or caution about deletion impact, even though markdown files should disclose behaviors that could affect system integrity or user resources.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The document instructs agents to use BRIGHTDATA_API_TOKEN and later references browser credentials, but it does not explicitly warn that these are sensitive secrets and should not be logged, echoed, or exposed in generated code or outputs. In markdown skills, omission of warnings about privacy-sensitive behavior can be a quality and safety issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.