brave-sear组合包

• Outcome: Review
• Latest audit: Aug 14, 2026 · 11:14 AM UTC
• Version: 1.0.1

Overview

This research bundle is not clearly malicious, but it requests broad command, file, API, and crawling capabilities with vague scope and inconsistent credential guidance.

Review this bundle carefully before installing. It may be appropriate for a controlled research environment, but only if you are comfortable granting command execution, file read/write access, API credential use, and crawler behavior to the member skills. Configure credentials only when you know which member skill needs them, and avoid using it on sensitive local files or private data without stronger scoping.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This file is presented as a marketing bundle/metadata wrapper, yet the manifest grants broad capabilities including exec and write. That mismatch is dangerous because users or downstream systems may trust it as a passive bundle while it can invoke commands and modify files, increasing the chance of over-privileged execution or capability smuggling through the bundle layer.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The documentation states that no external API is required, but later instructs users to configure API keys and establish credentialed API connections. This inconsistency can mislead reviewers and users about network exposure, secret handling, and trust boundaries, creating risk of inadvertent credential entry or unexpected external communication.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: Command execution is not justified by the stated role of this artifact as a packaging bundle for research skills. Unnecessary exec capability materially increases risk because any future prompt, misconfiguration, or downstream logic could trigger shell/system actions unrelated to the user's expectation of a simple bundle descriptor.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: Conflicting statements about external API requirements and credentialed API setup weaken transparency about the skill's true behavior. In security-sensitive environments, this can cause operators to underestimate data egress, mis-handle secrets, or approve a skill under false assumptions about its connectivity.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The feature and installation sections advertise file handling, API integration, and command execution, but do not provide concrete warnings about the security implications of those actions. In context, this bundle is framed as a convenient research package, so users may be less likely to expect file modification, secret use, or command execution, making unsafe deployment more likely.

Static analysis

No suspicious patterns detected.