Tavily Search V2

PassAudited by ClawScan on May 10, 2026.

Overview

This is a straightforward Tavily web-search skill, but users should notice that it sends search queries to Tavily and requires a Tavily API key.

This skill appears safe and purpose-aligned for Tavily web search. Before installing, make sure you trust Tavily with the search queries you submit, use a properly protected API key, and be aware that the bundled metadata does not exactly match the registry slug/version shown here.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Using the skill consumes or exercises access under the user's Tavily account/API key.

Why it was flagged

The script requires a Tavily API key and uses it as a bearer token for the Tavily API, which is expected for this service integration.

Skill content
const apiKey = (process.env.TAVILY_API_KEY ?? "").trim(); ... "Authorization": `Bearer ${apiKey}`
Recommendation

Use a dedicated Tavily API key if possible, avoid sharing it, and rotate it if it may have been exposed.

What this means

Search terms entered through the skill are shared with Tavily and may be visible to that provider under its policies.

Why it was flagged

The search query and selected options are sent to Tavily's external API; this data flow is disclosed and aligned with the skill's purpose.

Skill content
const resp = await fetch("https://api.tavily.com/search", { ... body: JSON.stringify(body) });
Recommendation

Do not include secrets, private personal data, or confidential internal details in search queries unless you are comfortable sending them to Tavily.

What this means

The naming/version mismatch could make it harder to verify exactly which package lineage this skill came from.

Why it was flagged

The bundled metadata differs from the evaluated registry metadata, which lists the slug as liang-tavily-search-v2 and version as 1.0.0; this is a provenance/versioning inconsistency, not evidence of malicious behavior.

Skill content
"slug": "liang-tavily-search", "version": "1.0.1"
Recommendation

Confirm the skill identity and source before installing if provenance matters for your environment.