T09 · Insecure Skill Coding Practices
Error
- Location
content.js:43- Finding
Unrestricted URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
- Remediation
View remediation
Security audit
Brave Search 1.0.1
Security checks for vulnerabilities and agentic risk
Overview
This is a real web search/content extraction skill, but it gives the agent broad URL-fetching ability with weak scoping and inaccurately describes its Brave integration.
Install only if you are comfortable giving the skill outbound network access from the agent host. Avoid using it on sensitive URLs or in environments where localhost, private intranet services, or cloud metadata endpoints are reachable, and prefer a version that uses the official Brave API, validates URLs and redirects, blocks private IP ranges, limits response size/type, and documents its network permissions clearly.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (16)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the underlying skill uses Brave website scraping and arbitrary third-party fetches rather than only the Brave Search API, the documentation materially understates the capability and trust boundary. That makes the skill more dangerous because users may approve an API-bounded search helper while actually granting a broad network retrieval primitive that can access attacker-chosen pages and pull page content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
If the underlying skill uses Brave website scraping and arbitrary third-party fetches rather than only the Brave Search API, the documentation materially understates the capability and trust boundary. That makes the skill more dangerous because users may approve an API-bounded search helper while actually granting a broad network retrieval primitive that can access attacker-chosen pages and pull page content.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./search.js "query" # Basic search (5 results)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./search.js "query" # Basic search (5 results)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./search.js "query" # Basic search (5 results)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./search.js "query" # Basic search (5 results)
Known Vulnerable Dependency: ws==8.18.3 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
This lockfile pins jsdom's transitive dependency ws to 8.18.3, and the provided advisories indicate that this version is affected by an information disclosure issue and a memory-exhaustion denial-of-service flaw. In the context of a web search/content-extraction skill that processes untrusted remote web content, vulnerable parsing/networking dependencies are more concerning because attacker-controlled sites or responses may be reachable during normal skill operation.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 83% confidence
- Finding
The skill advertises and instructs use of network-capable scripts but does not declare any explicit tool scope such as permissions or allowed-tools. That omission weakens policy enforcement and review because consumers cannot easily tell that the skill can reach external services and arbitrary URLs.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The headline and introductory wording are broad enough that an agent may invoke this skill in many loosely related situations involving web information. Over-broad activation criteria can cause unnecessary external requests, data exposure through queries or fetched URLs, and use of a networked skill when a local or safer alternative would suffice.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The 'When to Use' section is extremely broad, including 'any task requiring web search' and generic content fetching, which encourages routine activation without meaningful constraints. In context, this skill has network reach and content extraction ability, so vague triggers increase the chance of unnecessary external access, accidental leakage in queries, and retrieval of untrusted content.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The request hard-codes an
Accept-Languageheader ofen-US,en;q=0.9, which imposes a specific language/locale preference on all fetches. This is a natural-language locale policy concern because the skill does not offer a user opt-in or configuration for language selection.- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
The dependency uses a caret range instead of an exact pinned version, which allows future compatible releases to be installed. This creates supply-chain risk because builds may become non-reproducible and could silently pull in a compromised or vulnerable upstream release.
- Content
json "author": "Mario Zechner", "license": "MIT", "dependencies": { "@mozilla/readability": "^0.6.0", "jsdom": "^27.0.1", "turndown": "^7.2.2", "turndown-plugin-gfm": "^1.0.2"
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
The jsdom dependency is specified with a caret range, so installs may resolve to different future patch/minor versions over time. That increases supply-chain exposure and reduces build reproducibility, which is especially relevant for a skill that processes untrusted web content.
- Content
json "license": "MIT", "dependencies": { "@mozilla/readability": "^0.6.0", "jsdom": "^27.0.1", "turndown": "^7.2.2", "turndown-plugin-gfm": "^1.0.2" }
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
Using a non-exact version for turndown permits automatic drift to newer releases without explicit review. If an upstream release is compromised or introduces a security regression, consumers may ingest it unexpectedly.
- Content
json "dependencies": { "@mozilla/readability": "^0.6.0", "jsdom": "^27.0.1", "turndown": "^7.2.2", "turndown-plugin-gfm": "^1.0.2" } }
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
The turndown-plugin-gfm dependency is not pinned exactly, allowing future matching releases to be fetched automatically. This is a classic low-severity supply-chain hardening issue because it weakens reproducibility and trust over time.
- Content
json "@mozilla/readability": "^0.6.0", "jsdom": "^27.0.1", "turndown": "^7.2.2", "turndown-plugin-gfm": "^1.0.2" } }
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The request headers explicitly set
Accept-Languagetoen-US,en;q=0.9, which imposes an English locale on search interactions. This is a natural-language locale constraint with no user opt-in or explanation that the tool is intentionally region- or language-specific.- Content