ClawHub
Back to skill

Security audit

yee-brave-search

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward Brave Search integration that sends search terms and a Brave API key to Brave's search API, which matches its stated purpose.

Install only if you are comfortable sending your search queries to Brave Search and providing a Brave API key through BRAVE_API_KEY. Do not include secrets, private customer data, or confidential internal details in search queries.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Tainted flow: 'req' from os.getenv (line 26, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
try:
        req = urllib.request.Request(url, headers=headers)
        with urllib.request.urlopen(req) as response:
            if response.status == 200:
                data = json.loads(response.read().decode())
                results = []
Confidence
90% confidence
Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill advertises executable behavior that uses environment variables and network access, but it does not declare any explicit tool scope such as permissions or allowed-tools. This weakens reviewability and containment because users and platforms cannot easily see or enforce what capabilities the skill needs before installation or invocation.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill description and usage text do not clearly warn that user queries will be transmitted to Brave's external search service. Without an explicit disclosure, users may provide sensitive prompts or identifiers that are then sent off-platform, creating privacy and compliance risk.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The usage guidance is very broad: 'search for anything' could cause the agent to invoke the skill in many contexts without clear user intent or guardrails. Over-broad triggering increases the chance of accidental data disclosure in queries and unnecessary calls to an external service.

External Transmission

Medium
Category
Data Exfiltration
Content
# Brave Search API Configuration
# Reads from environment variable BRAVE_API_KEY
API_KEY = os.getenv("BRAVE_API_KEY")
BASE_URL = "https://api.search.brave.com/res/v1/web/search"

def search_brave(query, count=5):
    if not API_KEY:
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
User-supplied search queries are sent to an external third-party service, which can expose sensitive prompts, internal investigation topics, or personal data if users are unaware of the transmission. In a tool/skill context, this matters because queries may be constructed from broader agent context and not just explicit user text, increasing privacy and data-handling risk.

Static analysis

No suspicious patterns detected.