Brave Rotator

Brave Search API with automatic key rotation across multiple API keys to maximize free tier limits (2000 req/month per key). Use when performing web, news, o...

This skill legitimately implements key rotation for Brave Search, but it stores your API keys in plaintext in a state file and the registry metadata doesn't declare the required BRAVE_API_KEYS env var. Before installing or using it, consider: 1) review the script locally (you already have the code) and confirm you trust the source; 2) do not supply long-lived or high-privilege keys — prefer disposable keys; 3) change the code so it does not write raw keys to disk (store only masked identifiers or hashes, or avoid persistent state altogether), or set BRAVE_KEY_STATE_FILE to a secure, access-restricted path (or tmpfs); 4) run the skill in an isolated environment/container if possible; 5) if you cannot audit or modify the script, avoid providing multiple keys to it. Also consider updating registry metadata to declare BRAVE_API_KEYS so the requirement is explicit.

Type: OpenClaw Skill Name: openclaw-skill-brave-rotator Version: 0.1.0 The OpenClaw skill 'brave-rotator' is classified as benign. The `SKILL.md` file provides clear, non-malicious instructions for setting up and using the Brave Search API with key rotation, without any prompt injection attempts. The `scripts/brave_search.py` script correctly implements the described functionality, handling API keys from environment variables, managing a state file (`~/.brave_key_state.json`) for rotation, and making legitimate network calls to `api.search.brave.com`. There is no evidence of data exfiltration, unauthorized file access, arbitrary code execution, or other malicious intent.