Agent Economy ReportAgent Economy ReportCAUTION version 1.0.1 · audited 2026-09-17
This package provides two command-line Node.js tools: search.js searches Brave by scraping its HTML results page, and content.js fetches a supplied URL and converts readable page content to Markdown. The documented Brave Search API and BRAVE_API_KEY are not used by the code. With the --content flag, search.js automatically fetches every result link and prints extracted page text. No hidden network destinations, persistence, credential exfiltration, wallet/payment changes, or download-and-execute behavior was found. The main reasons for caution are arbitrary URL fetching without validation and untrusted web content being printed into the agent context.
Instructions try to steer the agent beyond the declared purpose. content.js prints Markdown converted from fetched web page content with console.log(htmlToMarkdown(article.content));. This content comes from an arbitrary remote URL and could contain instructions that influence an agent consuming the output.
| Declared purpose | Web search and content extraction via Brave Search API, no browser required. |
| Observed behavior | search.js builds a URL to https://search.brave.com/search, fetches the HTML, extracts result titles, links, and snippets, and optionally fetches each result page and prints truncated extracted text. content.js fetches an arbitrary URL argument and prints readable Markdown extracted from the response. The code does not read environment variables or write files. |
| Verdict, rules only | SAFE |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| network | needed | search.js fetches https://search.brave.com/search and, with --content, fetches result links; content.js fetches any URL supplied as a command-line argument. |
| shell | needed | The skill is intended to be run from a shell using Node.js scripts; SKILL.md documents bash commands such as ./search.js and ./content.js. |
| install_packages | needed | SKILL.md instructs npm ci, and package.json declares dependencies including @mozilla/readability, jsdom, turndown, and turndown-plugin-gfm. |
| severity | finding |
|---|---|
| medium | Scrapes Brave Search HTML instead of using the declared API The declared purpose says the skill uses the Brave Search API, but search.js fetches the ordinary Brave search results page directly. This is not an API call. search.js:36 https://search.brave.com/search?q=${encodeURIComponent(query)} |
| low | Advertised API key is not used by the code SKILL.md says the skill needs BRAVE_API_KEY, but neither search.js nor content.js reads process.env or uses an API key. A configured key would be unused; the actual request is unauthenticated. SKILL.md:19 Needs env: `BRAVE_API_KEY`. |
| medium | Arbitrary URL fetch without validation content.js fetches whatever URL is passed as a command-line argument, with no allowlist or validation. This can reach localhost, private hosts, or cloud metadata addresses from the agent environment. content.js:37 const response = await fetch(url, { |
| medium | Optional content mode fetches every result link automatically When --content is used, search.js sends a follow-up request to each link returned by Brave. These links are remote content and are fetched without a validation step. search.js:161 result.content = await fetchPageContent(result.link); |
| medium | Untrusted web content is printed into the agent context Fetched page content is converted to Markdown and written to stdout. If the agent consuming this output treats it as instructions, it is an indirect prompt-injection path. content.js:60 console.log(htmlToMarkdown(article.content)); |
| info | Publisher acknowledges arbitrary URL risk The skill card itself notes that page extraction can fetch arbitrary URLs and recommends reviewing URLs before execution. skill-card.md:29 Risk: The page extraction command can fetch arbitrary URLs from the agent environment. |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawhub.ai | not in the service index | skill-card.md:9 |
| doc.rust-lang.org | not in the service index | content.js:15 |
| example.com | not in the service index | SKILL.md:33 |
| github.com | not in the service index | package-lock.json:57 |
| opencollective.com | not in the service index | package-lock.json:61 |
| registry.npmjs.org | not in the service index | package-lock.json:20 |
| search.brave.com | not in the service index | search.js:36 |
| Binaries invoked | bash, node, npm |
| Environment variables read | none |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 3 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 57 | 57ec3e0c50296df2… |
_meta.json | 6 | e5d79fe568b3c74c… |
content.js | 86 | 849db5d89558bc65… |
package-lock.json | 621 | 11c66fb63205d49d… |
package.json | 14 | 736ea93972c9d70b… |
search.js | 179 | b60552e3396c1b37… |
skill-card.md | 59 | f11790f65eaa7119… |
For agents
JSON: https://agenteconomy.report/k/brave-search.audit.json · badge: https://agenteconomy.report/k/brave-search.audited.svg ·
skill rating: /k/brave-search · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).