brave-search
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill fetches and processes content from arbitrary external websites, which creates a surface for indirect prompt injection attacks where malicious instructions on a webpage could influence the agent's actions.
- Ingestion points: Untrusted data enters the agent's context in
content.js(line 49) andsearch.js(line 122) where external URLs are fetched. - Boundary markers: The skill lacks explicit delimiters or instructions for the agent to treat fetched content as data only, potentially allowing the agent to follow instructions embedded in search results.
- Capability inventory: The skill performs network operations (fetching external web pages) and returns the extracted text to the agent context.
- Sanitization: Although the skill uses
@mozilla/readabilityandturndownto remove HTML tags and scripts, these tools do not filter out natural language instructions intended to manipulate the AI agent.
Audit Metadata