ClawHub
Back to skill

Security audit

tavily-research-pro

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Tavily web research skill that sends user-provided searches or URLs to Tavily using a local API key, with no evidence of hidden persistence, destructive behavior, or unrelated data access.

Install only if you are comfortable sending search terms, requested URLs, and your Tavily API key to Tavily's API. Avoid using it with confidential queries, private/internal URLs, regulated data, or secrets in prompts.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (24)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill requires environment access for an API key and performs network operations, but it does not declare an explicit permission or allowed-tools scope. This creates a transparency and containment gap: hosts or reviewers may not clearly understand that the skill can exfiltrate user queries and access secrets needed for outbound requests, increasing the risk of overbroad execution in less restrictive runtimes.

Natural-Language Policy Violations

Medium
Confidence
90% confidence
Finding
The file presents core headings, feature descriptions, and usage guidance in a bilingual format with substantial Chinese text, but it does not state that this language choice is optional or targeted to a specific locale. Under the policy rule, forcing or assuming a language/locale without opt-in or justification is a natural-language policy concern.

External Transmission

Medium
Category
Data Exfiltration
Content
console.log(`\n🔍 **正在检索关于 "${query}" 的深度数据...**\n`);

const resp = await fetch("https://api.tavily.com/search", {
  method: "POST",
  headers: { 
    "Content-Type": "application/json",
Confidence
88% confidence
Finding
The hardcoded external endpoint confirms that the skill sends data outside the local environment to a third-party service. This is expected for a web search tool, so the context makes it less suspicious, but without explicit disclosure and query sensitivity controls it remains a genuine privacy/security concern.

External Transmission

Medium
Category
Data Exfiltration
Content
console.log(`\n🔍 **正在检索关于 "${query}" 的深度数据...**\n`);

const resp = await fetch("https://api.tavily.com/search", {
  method: "POST",
  headers: { 
    "Content-Type": "application/json",
Confidence
88% confidence
Finding
The hardcoded external endpoint confirms that the skill sends data outside the local environment to a third-party service. This is expected for a web search tool, so the context makes it less suspicious, but without explicit disclosure and query sensitivity controls it remains a genuine privacy/security concern.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The script sends the raw user query and the API key to a third-party service without any explicit disclosure, consent prompt, or data-handling notice. In a research/search skill, external transmission is expected, but undisclosed forwarding of potentially sensitive user input still creates a privacy and compliance risk if users assume queries stay local.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
This code reads a credential from an environment variable and sends it along with user-provided URLs to an external API. There is no confirmation prompt, visible disclosure message, or explanatory comment warning the user that their input and credential will be transmitted off-system.

External Transmission

Medium
Category
Data Exfiltration
Content
if (urls.length === 0) { console.error("No URLs provided"); process.exit(1); }

const apiKey = (process.env.TAVILY_API_KEY ?? "").trim();
const resp = await fetch("https://api.tavily.com/extract", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ api_key: apiKey, urls: urls }),
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
if (urls.length === 0) { console.error("No URLs provided"); process.exit(1); }

const apiKey = (process.env.TAVILY_API_KEY ?? "").trim();
const resp = await fetch("https://api.tavily.com/extract", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ api_key: apiKey, urls: urls }),
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
if (urls.length === 0) { console.error("No URLs provided"); process.exit(1); }

const apiKey = (process.env.TAVILY_API_KEY ?? "").trim();
const resp = await fetch("https://api.tavily.com/extract", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ api_key: apiKey, urls: urls }),
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Medium
Confidence
97% confidence
Finding
The file contains user-facing messages in Chinese, and the rest of the script continues this pattern in multiple console outputs. This forces a specific language for interaction without any user opt-in or documented locale constraint, which matches the language/locale policy violation criteria.

External Transmission

Medium
Category
Data Exfiltration
Content
}

const apiKey = (process.env.TAVILY_API_KEY ?? "").trim();
const resp = await fetch("https://api.tavily.com/extract", {
  method: "POST",
  headers: { 
    "Content-Type": "application/json",
Confidence
86% confidence
Finding
The hard-coded transmission endpoint indicates all extracted requests are sent to api.tavily.com, meaning user-provided targets and possibly sensitive research inputs leave the local environment. In the context of a research skill, this is expected functionality, but it still becomes dangerous if users can unknowingly submit internal or confidential URLs to a third party.

External Transmission

Medium
Category
Data Exfiltration
Content
}

const apiKey = (process.env.TAVILY_API_KEY ?? "").trim();
const resp = await fetch("https://api.tavily.com/extract", {
  method: "POST",
  headers: { 
    "Content-Type": "application/json",
Confidence
86% confidence
Finding
The hard-coded transmission endpoint indicates all extracted requests are sent to api.tavily.com, meaning user-provided targets and possibly sensitive research inputs leave the local environment. In the context of a research skill, this is expected functionality, but it still becomes dangerous if users can unknowingly submit internal or confidential URLs to a third party.

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
Lines L24-L30 present all report headings and guidance in Chinese only, including the final instruction to base professional decisions on the extracted data. Because no alternative language or opt-in mechanism is provided, the script enforces a single locale across its main user-visible output.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The comment and runtime messages indicate the skill is intended to operate in Chinese, and lines 29 and 45-49 present output only in Chinese. This creates a language/locale policy concern because the skill does not provide user opt-in or any configurable language selection.

External Transmission

Medium
Category
Data Exfiltration
Content
console.log(`\n🔍 **正在检索关于 "${query}" 的深度数据...**\n`);

const resp = await fetch("https://api.tavily.com/search", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
if (!query) { console.error("请输入分析话题。"); process.exit(1); }

const apiKey = (process.env.TAVILY_API_KEY ?? "").trim();
const resp = await fetch("https://api.tavily.com/search", {
  method: "POST",
  headers: { 
    "Content-Type": "application/json",
Confidence
92% confidence
Finding
The hardcoded Tavily endpoint confirms that the script is designed to transmit data off-host to an external service. In this skill context that behavior is functional rather than malicious, but it remains a real data-sharing risk if operators assume local-only processing or pass confidential search terms.

External Transmission

Medium
Category
Data Exfiltration
Content
if (!query) { console.error("请输入分析话题。"); process.exit(1); }

const apiKey = (process.env.TAVILY_API_KEY ?? "").trim();
const resp = await fetch("https://api.tavily.com/search", {
  method: "POST",
  headers: { 
    "Content-Type": "application/json",
Confidence
92% confidence
Finding
The hardcoded Tavily endpoint confirms that the script is designed to transmit data off-host to an external service. In this skill context that behavior is functional rather than malicious, but it remains a real data-sharing risk if operators assume local-only processing or pass confidential search terms.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script sends the user-supplied query directly to Tavily's external API without any explicit notice, consent prompt, or masking. If users enter sensitive topics, proprietary terms, or personal data, that information is disclosed to a third party and may be logged or retained externally.

Natural-Language Policy Violations

Low
Confidence
95% confidence
Finding
The file contains user-facing comments and console output in Chinese, including the retrieval status and result labels, with no indication that the skill is region-specific or that users can opt into a language. This creates a natural-language locale policy concern because the skill appears to enforce a specific language by default.

Natural-Language Policy Violations

Low
Confidence
97% confidence
Finding
The status message shown to users is hardcoded in Chinese and does not offer any language preference or fallback. For a general-purpose search skill, this is a locale-policy issue unless the skill is explicitly documented as Chinese-only.

Natural-Language Policy Violations

Low
Confidence
96% confidence
Finding
The output labels for AI insights and match score are hardcoded in Chinese, which forces a specific user-facing language. There is no visible opt-in, configuration, or documentation limiting the skill to a Chinese locale.

Natural-Language Policy Violations

Low
Confidence
84% confidence
Finding
The only descriptive comment in the file is in Chinese, which reflects a language-specific constraint without any indication that users may choose another language. The stated policy requires flagging language or locale restrictions unless they are optional or clearly justified.

Context-Inappropriate Capability

Low
Confidence
77% confidence
Finding
The skill's stated purpose is AI-powered search and research, and the network search behavior itself is expected. However, the code also depends on reading a credential from the process environment, a capability not mentioned in the manifest description and not inherent to the research/reporting purpose from an intent-auditing perspective.

Natural-Language Policy Violations

Low
Confidence
96% confidence
Finding
User-visible strings throughout the script are in Chinese, including the error message and output headings, and there is no indication that users can select another language. The stated policy flags language or locale constraints when they are imposed without user opt-in or clear justification.

Static analysis

No suspicious patterns detected.