tavily-research-pro

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 4:31 PM UTC
• Version: 1.1.1

Overview

This is a disclosed Tavily web research skill that sends user-provided searches or URLs to Tavily using a local API key, with no evidence of hidden persistence, destructive behavior, or unrelated data access.

Install only if you are comfortable sending search terms, requested URLs, and your Tavily API key to Tavily's API. Avoid using it with confidential queries, private/internal URLs, regulated data, or secrets in prompts.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (24)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill requires environment access for an API key and performs network operations, but it does not declare an explicit permission or allowed-tools scope. This creates a transparency and containment gap: hosts or reviewers may not clearly understand that the skill can exfiltrate user queries and access secrets needed for outbound requests, increasing the risk of overbroad execution in less restrictive runtimes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file presents core headings, feature descriptions, and usage guidance in a bilingual format with substantial Chinese text, but it does not state that this language choice is optional or targeted to a specific locale. Under the policy rule, forcing or assuming a language/locale without opt-in or justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The hardcoded external endpoint confirms that the skill sends data outside the local environment to a third-party service. This is expected for a web search tool, so the context makes it less suspicious, but without explicit disclosure and query sensitivity controls it remains a genuine privacy/security concern.

Content

Scanner excerpt · _meta.json (reported line 31)May include surrounding context.

json

console.log(`\n🔍 **正在检索关于 "${query}" 的深度数据...**\n`);

const resp = await fetch("https://api.tavily.com/search", {
  method: "POST",
  headers: { 
    "Content-Type": "application/json",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The hardcoded external endpoint confirms that the skill sends data outside the local environment to a third-party service. This is expected for a web search tool, so the context makes it less suspicious, but without explicit disclosure and query sensitivity controls it remains a genuine privacy/security concern.

Content

Scanner excerpt · _meta.json (reported line 31)May include surrounding context.

json

console.log(`\n🔍 **正在检索关于 "${query}" 的深度数据...**\n`);

const resp = await fetch("https://api.tavily.com/search", {
  method: "POST",
  headers: { 
    "Content-Type": "application/json",

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script sends the raw user query and the API key to a third-party service without any explicit disclosure, consent prompt, or data-handling notice. In a research/search skill, external transmission is expected, but undisclosed forwarding of potentially sensitive user input still creates a privacy and compliance risk if users assume queries stay local.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code reads a credential from an environment variable and sends it along with user-provided URLs to an external API. There is no confirmation prompt, visible disclosure message, or explanatory comment warning the user that their input and credential will be transmitted off-system.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/extract.mjs (reported line 9)May include surrounding context.

js

if (urls.length === 0) { console.error("No URLs provided"); process.exit(1); }

const apiKey = (process.env.TAVILY_API_KEY ?? "").trim();
const resp = await fetch("https://api.tavily.com/extract", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ api_key: apiKey, urls: urls }),

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/extract.mjs (reported line 9)May include surrounding context.

js

if (urls.length === 0) { console.error("No URLs provided"); process.exit(1); }

const apiKey = (process.env.TAVILY_API_KEY ?? "").trim();
const resp = await fetch("https://api.tavily.com/extract", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ api_key: apiKey, urls: urls }),

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search.mjs (reported line 31)May include surrounding context.

js

if (urls.length === 0) { console.error("No URLs provided"); process.exit(1); }

const apiKey = (process.env.TAVILY_API_KEY ?? "").trim();
const resp = await fetch("https://api.tavily.com/extract", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ api_key: apiKey, urls: urls }),

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file contains user-facing messages in Chinese, and the rest of the script continues this pattern in multiple console outputs. This forces a specific language for interaction without any user opt-in or documented locale constraint, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 86% confidence

Finding

The hard-coded transmission endpoint indicates all extracted requests are sent to api.tavily.com, meaning user-provided targets and possibly sensitive research inputs leave the local environment. In the context of a research skill, this is expected functionality, but it still becomes dangerous if users can unknowingly submit internal or confidential URLs to a third party.

Content

Scanner excerpt · scripts/report.mjs (reported line 12)May include surrounding context.

js

}

const apiKey = (process.env.TAVILY_API_KEY ?? "").trim();
const resp = await fetch("https://api.tavily.com/extract", {
  method: "POST",
  headers: { 
    "Content-Type": "application/json",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 86% confidence

Finding

The hard-coded transmission endpoint indicates all extracted requests are sent to api.tavily.com, meaning user-provided targets and possibly sensitive research inputs leave the local environment. In the context of a research skill, this is expected functionality, but it still becomes dangerous if users can unknowingly submit internal or confidential URLs to a third party.

Content

Scanner excerpt · scripts/report.mjs (reported line 12)May include surrounding context.

js

}

const apiKey = (process.env.TAVILY_API_KEY ?? "").trim();
const resp = await fetch("https://api.tavily.com/extract", {
  method: "POST",
  headers: { 
    "Content-Type": "application/json",

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Lines L24-L30 present all report headings and guidance in Chinese only, including the final instruction to base professional decisions on the extracted data. Because no alternative language or opt-in mechanism is provided, the script enforces a single locale across its main user-visible output.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The comment and runtime messages indicate the skill is intended to operate in Chinese, and lines 29 and 45-49 present output only in Chinese. This creates a language/locale policy concern because the skill does not provide user opt-in or any configurable language selection.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search.mjs (reported line 31)May include surrounding context.

js

console.log(`\n🔍 **正在检索关于 "${query}" 的深度数据...**\n`);

const resp = await fetch("https://api.tavily.com/search", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

The hardcoded Tavily endpoint confirms that the script is designed to transmit data off-host to an external service. In this skill context that behavior is functional rather than malicious, but it remains a real data-sharing risk if operators assume local-only processing or pass confidential search terms.

Content

Scanner excerpt · scripts/sentiment.mjs (reported line 8)May include surrounding context.

js

if (!query) { console.error("请输入分析话题。"); process.exit(1); }

const apiKey = (process.env.TAVILY_API_KEY ?? "").trim();
const resp = await fetch("https://api.tavily.com/search", {
  method: "POST",
  headers: { 
    "Content-Type": "application/json",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

The hardcoded Tavily endpoint confirms that the script is designed to transmit data off-host to an external service. In this skill context that behavior is functional rather than malicious, but it remains a real data-sharing risk if operators assume local-only processing or pass confidential search terms.

Content

Scanner excerpt · scripts/sentiment.mjs (reported line 8)May include surrounding context.

js

if (!query) { console.error("请输入分析话题。"); process.exit(1); }

const apiKey = (process.env.TAVILY_API_KEY ?? "").trim();
const resp = await fetch("https://api.tavily.com/search", {
  method: "POST",
  headers: { 
    "Content-Type": "application/json",

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script sends the user-supplied query directly to Tavily's external API without any explicit notice, consent prompt, or masking. If users enter sensitive topics, proprietary terms, or personal data, that information is disclosed to a third party and may be logged or retained externally.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file contains user-facing comments and console output in Chinese, including the retrieval status and result labels, with no indication that the skill is region-specific or that users can opt into a language. This creates a natural-language locale policy concern because the skill appears to enforce a specific language by default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The status message shown to users is hardcoded in Chinese and does not offer any language preference or fallback. For a general-purpose search skill, this is a locale-policy issue unless the skill is explicitly documented as Chinese-only.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The output labels for AI insights and match score are hardcoded in Chinese, which forces a specific user-facing language. There is no visible opt-in, configuration, or documentation limiting the skill to a Chinese locale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The only descriptive comment in the file is in Chinese, which reflects a language-specific constraint without any indication that users may choose another language. The stated policy requires flagging language or locale restrictions unless they are optional or clearly justified.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The skill's stated purpose is AI-powered search and research, and the network search behavior itself is expected. However, the code also depends on reading a credential from the process environment, a capability not mentioned in the manifest description and not inherent to the research/reporting purpose from an intent-auditing perspective.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

User-visible strings throughout the script are in Chinese, including the error message and output headings, and there is no indication that users can select another language. The stated policy flags language or locale constraints when they are imposed without user opt-in or clear justification.

Content

No source excerpt is available for this finding.