Trust Assessment
brave-images received a trust score of 82/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Potential Command Injection via URL Query Parameter, API Key Handling Requirement.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 12, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential Command Injection via URL Query Parameter The skill documentation describes a `q` parameter for the Brave Search API that takes a search query and explicitly states it should be 'URL-encoded'. If the AI agent constructs a `curl` command using raw, unencoded user input for this parameter, it could lead to command injection if the `curl` command is executed in a shell environment. Malicious input like `foo&echo pwned` could execute arbitrary commands. Ensure all user-provided input for the `q` parameter is strictly and correctly URL-encoded before being incorporated into any shell command or HTTP request. Implement robust input validation and sanitization. | LLM | SKILL.md:12 | |
| MEDIUM | API Key Handling Requirement The skill explicitly requires and uses the `BRAVE_API_KEY` environment variable for authentication. While necessary for functionality, the AI agent must ensure this sensitive credential is handled securely. There is a risk of credential exposure if the API key is inadvertently logged, echoed in user-facing output, or transmitted insecurely by the agent when constructing or executing the `curl` command. The AI agent must be programmed to handle `BRAVE_API_KEY` securely. This includes ensuring it is never logged, stored persistently, or exposed in any output visible to the user or other unauthorized parties. Use secure environment variable access and avoid printing the full `curl` command with the key if it's not strictly necessary for debugging in a secure environment. | LLM | SKILL.md:7 |
Scan History
Embed Code
[](https://skillshield.io/report/1bc6122209b81c5b)
Powered by SkillShield