brave-shim

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:10 AM UTC
• Version: 1.0.0

Overview

This skill clearly aims to provide a local Brave-to-DuckDuckGo search proxy, but it does so by rewriting OpenClaw's installed provider code and running unpinned third-party code and dependencies.

Review carefully before installing. Only use this in a disposable or tightly controlled OpenClaw environment, inspect and pin the brave_shim repository and Python dependencies, back up OpenClaw files before patching, and avoid sending sensitive searches or LLM context through the shim unless you trust the local service and its dependencies.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/setup_brave_shim.py:6

Finding

Unpinned Remote Repository Is Downloaded and Executed

Content

View full analysis

1 else DEFAULT_SHIM if not os.path.exists(shim_path): print(f"brave_shim.py not found at {shim_path}") print("Run scripts/setup_brave_shim.py first, or pass path as argument") sys.exit(1) venv_python = os.path.join(os.path.dirname(shim_path), "venv", "Scripts" if sys.platform == "win32" else "bin", "python") if not os.path.exists(venv_python): venv_python = "python" # fallback to system python print(f"Starting brave_shim from {shim_path}...") subprocess.run(f'"{venv_python}" "{shim_path}"', shell=True) ``` ### Technical Analysis The setup script clones the current state of a third-party GitHub repository without selecting an immutable commit or verifying a cryptographic digest or signature. The start script subsequently executes `brave_shim.py` from that clone. Consequently, the effective code executed by the Skill can change after the Skill itself has been reviewed. The downloaded source is not present in the audited project, so its behavior—including handling of search queries, credentials, H ...[truncated 1492 chars]

Remediation

View remediation

T07 · Tool Hijacking and Spoofing

Error

• Location: scripts/patch_openclaw.py:6

Finding

OpenClaw Provider Is Hijacked by Rewriting Installed Application Code

Content

View full analysis

{new[:40]}...") count += 1 if new_content != content: open(fpath, "w").write(new_content) if count == 0: print("No patches applied - BRAVE_SEARCH_ENDPOINT already patched or file not found") else: print(f"Done. {count} replacement(s) made.") ``` The corresponding instructions in `SKILL.md:39-56` also direct users to replace the official Brave endpoints with the local HTTP service. ### Technical Analysis The script directly edits OpenClaw's installed JavaScript bundle, replacing the official HTTPS Brave Search and LLM-context endpoints with an unauthenticated local HTTP endpoint. This is not an isolated provider configuration: it modifies another installed application's executable code and changes the destination of legitimate-looking API calls. The local shim can observe, ...[truncated 1790 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/setup_brave_shim.py:24

Finding

Runtime Installation of Unpinned Dependencies Enables Supply-Chain Substitution

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Using subprocess.run with shell=True gives the script a generic command-execution primitive, which is especially sensitive in an agent skill because the skill may be triggered in semi-automated workflows. Even if this file does not directly accept user input, the pattern enables abuse if any variable, path, or future change becomes attacker-influenced, and the setup context magnifies impact because commands install software and modify the environment.

Content

Scanner excerpt · scripts/setup_brave_shim.py (reported line 12)May include surrounding context.

python

def run(cmd, check=True, **kwargs):
    print(f"Running: {cmd}")
    r = subprocess.run(cmd, shell=True, **kwargs)
    if check and r.returncode != 0:
        sys.exit(f"Failed: {cmd}")
    return r

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

This is a tool-parameter abuse issue because a high-risk execution primitive is directly parameterized by external input. The skill's purpose is to configure a local proxy, so allowing runtime substitution of the executed program is more dangerous than necessary and can let an attacker pivot from benign setup to arbitrary process execution.

Content

Scanner excerpt · scripts/start_shim.py (reported line 22)May include surrounding context.

python

venv_python = "python"  # fallback to system python

    print(f"Starting brave_shim from {shim_path}...")
    subprocess.run(f'"{venv_python}" "{shim_path}"', shell=True)

if __name__ == "__main__":
    main()

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill instructs users to clone a repository, install packages, patch local application files, and run a local Python service, which clearly implies shell, file read, and file write capabilities. Omitting an explicit tool scope/permissions declaration makes the skill less transparent and weakens security review, increasing the chance an agent executes high-impact actions without informed consent or proper sandboxing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill directs the user to overwrite bundled OpenClaw JavaScript files to redirect Brave API traffic to a locally hosted proxy. Modifying application distribution files is risky because it changes trusted program behavior, persists across sessions, can break updates or integrity guarantees, and creates a path for traffic interception or tampering without a prominent warning or rollback guidance.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/patch_openclaw.py (reported line 8)May include surrounding context.

python

OPENCLAW_DIST = r"F:\npm\node_modules\openclaw\dist"
REPLACEMENTS = {
    "const BRAVE_SEARCH_ENDPOINT = \"https://api.search.brave.com/res/v1/web/search\";":
        "const BRAVE_SEARCH_ENDPOINT = \"http://127.0.0.1:8000/res/v1/web/search\";",
    "const BRAVE_LLM_CONTEXT_ENDPOINT = \"https://api.search.brave.com/res/v1/llm/context\";": 
        "const BRAVE_LLM_CONTEXT_ENDPOINT = \"http://127.0.0.1:8000/res/v1/llm/context\";",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/patch_openclaw.py (reported line 10)May include surrounding context.

python

OPENCLAW_DIST = r"F:\npm\node_modules\openclaw\dist"
REPLACEMENTS = {
    "const BRAVE_SEARCH_ENDPOINT = \"https://api.search.brave.com/res/v1/web/search\";":
        "const BRAVE_SEARCH_ENDPOINT = \"http://127.0.0.1:8000/res/v1/web/search\";",
    "const BRAVE_LLM_CONTEXT_ENDPOINT = \"https://api.search.brave.com/res/v1/llm/context\";": 
        "const BRAVE_LLM_CONTEXT_ENDPOINT = \"http://127.0.0.1:8000/res/v1/llm/context\";",

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script has the ability to execute git, venv creation, and pip installation commands, which gives it broader system-modifying capability than simply toggling or configuring a local shim. In a skill context, this is more dangerous because invoking the skill causes code retrieval and package installation from external sources, creating supply-chain and execution risk beyond the stated user-facing purpose.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 96% confidence

Finding

The helper executes shell commands with shell=True, which makes command parsing depend on the shell and increases the risk of command injection if any command component becomes user-controlled or environment-influenced. In this script the current command strings are mostly constant, but they incorporate file paths and external tooling, so the pattern is still unsafe and unnecessarily expands the attack surface of a setup script that already performs network and package operations.

Content

Scanner excerpt · scripts/setup_brave_shim.py (reported line 12)May include surrounding context.

python

def run(cmd, check=True, **kwargs):
    print(f"Running: {cmd}")
    r = subprocess.run(cmd, shell=True, **kwargs)
    if check and r.returncode != 0:
        sys.exit(f"Failed: {cmd}")
    return r

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The implementation clones a remote GitHub repository and installs Python packages at setup time, which is remote code retrieval plus dependency installation rather than mere local proxy configuration. This is dangerous because it introduces supply-chain exposure: a compromised repository, dependency, or transient package version could result in arbitrary code execution on the host during setup or later use.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script accepts a user-provided path and will execute whatever Python file exists there, not just the intended local brave_shim server. In a skill context, this broadens the capability from starting a known helper service to arbitrary code execution, which is especially dangerous if an agent or user can be induced to pass attacker-controlled paths.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 97% confidence

Finding

The script builds a shell command from variable paths and executes it with shell=True, which creates a command-injection surface. Because shim_path is taken from argv and venv_python is derived from filesystem state, an attacker who can supply or influence these values could execute arbitrary commands instead of merely launching the shim.

Content

Scanner excerpt · scripts/start_shim.py (reported line 22)May include surrounding context.

python

venv_python = "python"  # fallback to system python

    print(f"Starting brave_shim from {shim_path}...")
    subprocess.run(f'"{venv_python}" "{shim_path}"', shell=True)

if __name__ == "__main__":
    main()