ClawHub
Back to skill

Security audit

Brightdata

Security checks for vulnerabilities and agentic risk

Overview

This Bright Data skill does what it claims, but unsafe shell input handling could let a crafted search cursor run local commands.

Review before installing. Use this only with trusted agent inputs, avoid sensitive queries or private/restricted URLs, and prefer a version that validates the cursor as a non-negative integer and builds JSON with a real serializer before sending requests to Bright Data.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/search.sh:7
Finding

Unvalidated Cursor Input Allows Bash Arithmetic Injection

Content
View full analysis
Remediation
View remediation
&2 exit 1 fi if (( CURSOR > 1000 )); then echo "Error: cursor exceeds the permitted range" >&2 exit 1 fi START=$((10#$CURSOR * 10)) ``` Additional hardening measures: 1. Use `10#$CURSOR` to force decimal interpretation and avoid octal-related behavior for values with leading zeroes. 2. Apply a reasonable upper bound to prevent excessive API usage and integer edge cases. 3. Enable stricter shell behavior with `set -euo pipefail`, while handling expected command failures explicitly. 4. Consider implementing request construction in a language with strongly typed integer parsing if this script grows in complexity. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/scrape.sh:20
Finding

Unescaped Input Is Embedded Directly in Bright Data JSON Requests

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The implemented code only supports one subset of the declared description: fetching a provided URL through Bright Data and returning markdown content. The declared purpose additionally emphasizes Google search results, structured SERP data, and pagination support, but there is no code for issuing search queries, handling SERP endpoints, parsing search results, or iterating through pages. Therefore the description overstates the skill's capabilities in a material way.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The implemented shell script matches part of the description: it accepts a search query, supports pagination through the cursor/start parameter, calls Bright Data's SERP API, and returns structured search results. However, the declared purpose also claims web page scraping and clean markdown extraction from any URL, which are not present in this code chunk. Since those are substantive advertised capabilities rather than minor implementation details, the description overstates what the supplied code actually does.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill declares shell-based execution requirements but does not define any explicit tool scope such as allowed-tools or permissions. In an agent environment, this increases the chance of unintended command execution or overly broad runtime access because consumers cannot tell what capabilities are intentionally exposed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly states that it bypasses bot detection and CAPTCHAs and sends traffic through a third-party scraping/search provider, but it does not warn users about those behaviors. This creates legal, privacy, and policy risk because users may unknowingly submit queries or URLs to an external service that performs potentially sensitive scraping on their behalf.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/scrape.sh (reported line 20)May include surrounding context.

sh
fi

# Use Bright Data Web Unlocker to fetch the page and convert to markdown
RESPONSE=$(curl -s -H "Authorization: Bearer $BRIGHTDATA_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"zone\":\"$BRIGHTDATA_UNLOCKER_ZONE\",\"url\":\"$URL\",\"format\":\"markdown\"}" \
  https://api.brightdata.com/request)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This shell script performs a network request to a third-party service and includes the user-provided URL in the request body. While the script comments state it uses Bright Data Web Unlocker, there is no explicit runtime disclosure or warning that input data will be transmitted off-system, which is relevant for privacy and safety.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/scrape.sh (reported line 23)May include surrounding context.

sh
RESPONSE=$(curl -s -H "Authorization: Bearer $BRIGHTDATA_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"zone\":\"$BRIGHTDATA_UNLOCKER_ZONE\",\"url\":\"$URL\",\"format\":\"markdown\"}" \
  https://api.brightdata.com/request)

# Check if we got a response
if [ -z "$RESPONSE" ]; then

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search.sh (reported line 24)May include surrounding context.

sh
RESPONSE=$(curl -s -H "Authorization: Bearer $BRIGHTDATA_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"zone\":\"$BRIGHTDATA_UNLOCKER_ZONE\",\"url\":\"$URL\",\"format\":\"markdown\"}" \
  https://api.brightdata.com/request)

# Check if we got a response
if [ -z "$RESPONSE" ]; then

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search.sh (reported line 24)May include surrounding context.

sh
URL="https://www.google.com/search?q=$(echo "$QUERY" | sed 's/ /+/g')&hl=en&gl=us&num=10&start=$((CURSOR * 10))"

# Use Bright Data SERP API to get structured results
RESPONSE=$(curl -s -X POST https://api.brightdata.com/request \
  -H "Authorization: Bearer $BRIGHTDATA_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This code sends the provided query to Bright Data’s remote SERP API, which is a network operation involving user-supplied data. Although the script has internal comments, there is no user-facing print, prompt, or runtime disclosure informing the user that their query will be transmitted to a third-party service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The search URL forces hl=en and gl=us, which imposes a specific language and locale on all searches. This is a natural-language policy concern because the script does not provide opt-in, configurability, or justification for restricting results to English and the US.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.