Security audit

搜索

Security checks for vulnerabilities and agentic risk

Overview

This Brave Search skill is not clearly malicious, but it asks for command and local file capabilities that are broader than needed for web search.

Review this skill carefully before installing. Use it only for non-sensitive Brave Search queries, and avoid giving it confidential prompts, secrets, or local files. The main concern is not hidden destructive code, but overbroad documented authority: command execution and local file handling are not clearly necessary for search.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill is presented as a Brave Search web-search/content-extraction integration, but the documentation broadens its scope into SEO optimization, ranking improvement, analytics, reporting, and visualization. This scope inflation can mislead an agent into invoking the skill for tasks outside its justified purpose, increasing the chance of unnecessary data disclosure to external services and unsafe tool use.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The documentation claims file handling and command execution capabilities even though the skill is described as a Brave Search API integration. Advertising unrelated powerful capabilities encourages over-privileged use and may cause an agent to read, write, or execute local resources under the mistaken belief that such behavior is part of normal search functionality.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: Documenting command execution for a web-search/content-extraction skill is unjustified and materially raises risk because an agent may execute shell commands in response to user requests that should only require remote search. This creates a path to local command abuse, environment inspection, and accidental handling of sensitive files or secrets.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: A Brave Search skill does not need file write capability to perform search and content extraction, so documenting such capability violates least privilege. If an agent believes writes are expected, it may persist sensitive search results, user prompts, or extracted content locally without clear user intent or security controls.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The invocation guidance is overly broad, suggesting use for a wide range of SEO, analytics, reporting, and decision-support tasks unrelated to simple search. Ambiguous activation conditions can cause an agent to route inappropriate requests through this skill, increasing external data exposure and the chance of using higher-risk tools under vague justification.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill does not clearly warn that user queries and provided context will be sent to an external Brave Search API service. Without an explicit disclosure, agents or users may unintentionally transmit sensitive prompts, internal data, or proprietary context to a third party.

Static analysis

No suspicious patterns detected.