web-search

The script is a DuckDuckGo search wrapper, but its query handling permits Python code injection: crafted JSON input can execute arbitrary code as the invoking user. The script sends the search query to api[.]duckduckgo[.]com; no credential theft or other malicious behavior is evident. This is a high-severity input-handling vulnerability, not clear evidence of intentional malware.

This script provides Brave Search API functionality and sends BRAVE_API_KEY to api[.]search[.]brave[.]com as documented. Its query interpolation into Python source enables local code execution if an attacker can supply a crafted query; country and freshness are also concatenated into the request URL without validation. Severity is high if JSON input is attacker-controlled, otherwise the issue depends on the caller's trust boundary; no evidence of credential theft or unrelated network activity is present.