ClawHub
Back to skill

Security audit

X Interact

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward X/Twitter search helper for Tavily, with the main caution that its setup examples handle the Tavily API key unsafely.

Install only if you intend to use Tavily for X/Twitter research. Use a dedicated Tavily API key, avoid pasting real keys into shared terminals, chats, screenshots, or logs, rotate the key if exposed, and avoid sending sensitive private queries or URLs unless you are comfortable sharing them with Tavily.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The README instructs users to place the Tavily API key directly in a command-line URL, which can expose the credential through shell history, terminal logging, process listings, and copied configuration snippets. Because this skill is specifically about interacting with an external service that requires an API key, the unsafe setup guidance is more dangerous in context: users are likely to follow it verbatim and leak a live secret.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The setup command places the Tavily API key directly in a shell command URL, which can leak credentials through shell history, terminal logging, process inspection, screenshots, or copied transcripts. In an agent/tooling environment, this is more dangerous because users may paste the command into monitored systems or shared sessions, exposing a live API credential.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.