Brave Search Setup

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:30 PM UTC
• Version: 1.0.0

Overview

This appears to be a legitimate Brave Search setup guide, but it asks users to handle API keys and make persistent proxy/system changes without enough guardrails.

Review the commands before installing or using this skill. Prefer secret-entry methods that do not put API keys in shell history, use temporary/session-scoped proxy settings first, and avoid the sudo proxychains configuration unless you understand the system-wide file change and have a rollback plan.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:18
• Finding: Brave API Key Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 18-20 **Vulnerability Type**: Secret exposure through command-line arguments **Risk Level**: Medium ```bash # Option A: Via config.patch (key will be stored securely) openclaw gateway config.patch --raw '{"tools":{"web":{"search":{"apiKey":"YOUR_BRAVE_API_KEY","enabled":true,"provider":"brave"}}}}' ``` ### Technical Analysis The instructions encourage users to replace `YOUR_BRAVE_API_KEY` with a real credential inside a command-line argument. Although the destination configuration may store the key securely, the command used to populate it can expose the credential before storage. The complete command may be retained in shell history and can potentially be observed in process listings while it is executing. Terminal-session recording, diagnostic collection, shell-history synchronization, or backup software could also capture it. This conflicts with the comment claiming that the key “will be stored securely,” because only the final storage location is addressed, not the insecure transmission through the shell command. No evidence indicates that the Skill sends this key to an unauthorized remote endpoint. The issue is local credential disclosure caused by unsafe secret handling. ### Attack Path 1. A user replaces `YOUR_BRAVE_API_KEY` with a valid Brave API key. 2. The user executes the documented `openclaw gateway config.patch` command. 3. The command containing the plaintext key is recorded in shell history or briefly exposed through process inspection. 4. A local account, support bundle, terminal recorder, history backup, or malware with access to that data obtains the key. 5. The exposed credential is used to submit unauthorized Brave Search API requests. ### Impact Assessment An attacker who recovers the key can act within the permissions and quota assigned to that Brave API credential. Likely consequences include unauthorized API consumption, quota depletion, billing impact where ...[truncated 199 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not place API keys directly in command-line arguments. - Prefer an interactive secret prompt that disables terminal echo and passes the value through standard input or a protected file descriptor. - If OpenClaw supports environment-variable expansion or secret references, document that mechanism instead of literal substitution. - If a temporary credential file is unavoidable, create it with permissions set to `0600`, avoid predictable paths, and delete it immediately after use. - Warn users not to save credentials in shell history and provide explicit credential-rotation instructions for keys that may already have been exposed. - Revise the “stored securely” comment to clarify that both input handling and storage must be protected. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:122
• Finding: Brave API Key Exposed in Direct curl Test Command<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 122-124 **Vulnerability Type**: Secret exposure through command-line arguments **Risk Level**: Medium ```bash curl -s "https://api.search.brave.com/res/v1/web/search?q=test&count=1" \ -H "Accept: application/json" \ -H "X-Subscription-Token: YOUR_API_KEY" ``` ### Technical Analysis The troubleshooting command instructs users to insert the Brave API key directly into a `curl` header supplied as a command-line argument. A real key entered this way can remain in shell history and may be visible to local process inspection while `curl` is running. The request uses HTTPS and targets the declared official Brave Search API endpoint. Therefore, the network transmission is necessary for the Skill's stated functionality and there is no evidence of unauthorized exfiltration. The vulnerability is the local plaintext handling of the credential before the HTTPS request is sent. ### Attack Path 1. A user substitutes a valid key for `YOUR_API_KEY` in the documented command. 2. The user runs the command to diagnose Brave API connectivity. 3. The plaintext header and key are retained in shell history or captured from the process command line, terminal logs, or diagnostic data. 4. An attacker with access to those local records extracts the credential. 5. The attacker reuses the key against the Brave Search API. ### Impact Assessment Credential theft permits unauthorized requests under the victim's Brave API account and within the key's assigned permissions. This can consume request quotas, create billing exposure where applicable, and impair the legitimate integration through quota exhaustion. The command does not transmit the key to an undeclared host, execute a remote payload, establish persistence, or escalate operating-system privileges. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace direct header substitution with a method that does not expose the key in process arguments. - Prompt for the key without terminal echo and pass the generated header through standard input or a protected file descriptor where supported. - Alternatively, use a temporary curl configuration file protected with mode `0600`, then securely remove it after the test. - Avoid recommending a persistent plaintext environment variable as the sole fix, because environment data can also leak through child processes and diagnostics. - Add guidance to clear affected shell-history entries and rotate any credential previously entered directly into the command. - Keep HTTPS certificate verification enabled and retain the official `api.search.brave.com` endpoint. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

External Transmission

Medium

• Category: Data Exfiltration

Content

Test directly with curl:
```bash
curl -s "https://api.search.brave.com/res/v1/web/search?q=test&count=1" \
  -H "Accept: application/json" \
  -H "X-Subscription-Token: YOUR_API_KEY"
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

Test directly with curl:
```bash
curl -s "https://api.search.brave.com/res/v1/web/search?q=test&count=1" \
  -H "Accept: application/json" \
  -H "X-Subscription-Token: YOUR_API_KEY"
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

brew install proxychains-ng

# Configure
sudo tee /usr/local/etc/proxychains.conf <<EOF
strict_chain
proxy_dns
[ProxyList]

• Confidence: 84% confidence
• Finding: The skill instructs use of sudo tee to write a system-wide proxychains configuration under /usr/local/etc. Although this is a common administration step, elevated execution increases the risk of unintended system-wide changes, misuse if the pasted content is altered, and broader impact on networking behavior for other tools.

Missing User Warnings

Low

• Confidence: 92% confidence
• Finding: The skill instructs users to append proxy environment variables to ~/.zshrc, which makes the proxy persistent across future shell sessions and can silently affect unrelated tools and traffic. In a networking/proxy setup skill this is contextually relevant, but the lack of an explicit warning about persistence and broader system effects can lead to misconfiguration, privacy issues, or confusing network behavior.

Static analysis

No suspicious patterns detected.