Web Search Tavily

PassAudited by ClawScan on May 10, 2026.

Overview

The skill appears to do what it claims—run web searches and URL extraction through AIsa/Tavily—but users should know it sends queries, URLs, and an AISA API key to AIsa and has minor metadata provenance inconsistency.

This looks like a straightforward API-based web search skill. Before installing, make sure you trust AIsa/Tavily with submitted search queries and URLs, use a dedicated API key if possible, and verify the publisher because the registry metadata and bundled _meta.json are not fully consistent.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

Search terms and search options are sent to AIsa's API service.

Why it was flagged

The script sends search queries and options to an external API endpoint. This is disclosed and purpose-aligned for a web search skill, but users should understand the external data flow.

Skill content

const resp = await fetch("https://api.aisa.one/apis/v1/tavily/search", { method: "POST", ... body: JSON.stringify(body) });

Recommendation

Avoid submitting confidential queries unless you trust the AIsa/Tavily service and its handling of request data.

Low

#ASI03: Identity and Privilege Abuse

What this means

The skill can use the configured AIsa account/API key when invoked, which may affect account usage or billing depending on the provider.

Why it was flagged

The script reads AISA_API_KEY from the environment and uses it as a bearer token for AIsa API calls. This is expected for the stated integration and no unrelated credential use is shown.

Skill content

const apiKey = (process.env.AISA_API_KEY ?? "").trim(); ... "Authorization": `Bearer ${apiKey}`

Recommendation

Use a dedicated, least-privilege API key if available and monitor provider usage.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

The published package identity is slightly ambiguous, making publisher verification less straightforward.

Why it was flagged

The registry metadata and packaged _meta.json do not match exactly. This does not show malicious behavior, but it is a provenance consistency issue users may want to verify.

Skill content

Registry owner/slug: kn76s7azw5ts056pvhv1adht7s8052ne / ai-native-websearch-via-tavily-api-returns-concise-relevant-results-for-openclaw; _meta.json owner/slug: kn7azq5e6sw0fbwwzdpcwvvjzd7z0x4z / aisa-tavily-search

Recommendation

Confirm that the registry listing, homepage, and expected publisher are trustworthy before installing.