Security audit

Brave搜索工具-免费版

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a Brave Search helper, but its instructions broaden into generic file handling and command execution without clear boundaries.

Review this before installing. Use it only for non-sensitive web searches and explicitly provided public URLs, avoid confidential/internal queries, and do not rely on the broad file-processing or generic command-execution claims unless the missing scripts and dependencies are independently verified.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill is presented as a narrowly scoped Brave search/content-extraction tool, but later documentation expands it into generic file processing, automation, API integration, and command execution. This scope inflation can cause an agent to apply the skill in unintended contexts and justify broader read/write/exec behavior than users expect, increasing the risk of unsafe actions.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The document is internally inconsistent: it advertises Brave search/content extraction, then describes a general-purpose automation tool with file handling and command execution. This mismatch undermines trust boundaries and may lead orchestration systems or users to approve a tool under a narrower mental model than what the instructions later permit.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The trigger conditions are broad and ambiguous, especially around SEO optimization, keyword analysis, ranking improvement, and traffic optimization. Overbroad activation criteria increase the chance an agent invokes this skill for loosely related requests, potentially sending sensitive queries externally or performing exec-backed actions when a safer or more appropriate tool should be used.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill includes examples that save extracted content to local files but does not clearly warn that this performs filesystem writes. In agent environments, undocumented writes can surprise users, overwrite existing data, or persist sensitive externally sourced content locally without informed consent.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill sends search queries, URLs, and page-fetch requests to external services but does not prominently disclose this privacy boundary. Users may unknowingly expose sensitive research topics, internal URLs, or proprietary context to Brave or target websites, which is especially risky in enterprise or confidential workflows.

Static analysis

No suspicious patterns detected.