Security audit
Security checks for vulnerabilities and agentic risk
This skill is a small Tavily web search and extraction helper whose external API use is purpose-aligned and does not show hidden persistence, privilege escalation, or destructive behavior.
Install only if you are comfortable sending search queries, submitted URLs, and your Tavily API key to Tavily's API. Avoid using it with confidential internal URLs, secrets, regulated data, or proprietary research terms unless your organization permits that external processing.
The skill requires an API key and performs external searches, which implies access to environment data and network egress, but it does not declare any explicit tool scope or permission boundaries. This increases the risk of overbroad execution in hosts that rely on manifest-declared permissions, making unintended secret exposure or unsanctioned outbound requests harder to govern.
The description, headings, and usage explanations are presented in Chinese, which imposes a specific language on users. There is no indication that the skill is region-specific or that users can opt into another language, so this appears to violate the language/locale policy.
The examples and feature descriptions encourage users to submit search terms and URLs, but the skill does not warn that these inputs are transmitted to an external third-party service. Users may unknowingly send sensitive prompts, internal URLs, or proprietary research targets off-system, creating confidentiality and privacy risks.
Multiple console messages are hardcoded in Chinese, which imposes a specific language on all users. The file does not offer localization, opt-in language selection, or any documented reason that the skill must be Chinese-only.
The presence of a hardcoded third-party API endpoint confirms dependency on external infrastructure and data egress. This is not inherently malicious, but in a skill handling arbitrary URLs it increases the chance of unintentional disclosure of sensitive destinations and content to the external provider.
process.exit(1);
}
const resp = await fetch("https://api.tavily.com/extract", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({ api_key: apiKey, urls: [url] }),
The presence of a hardcoded third-party API endpoint confirms dependency on external infrastructure and data egress. This is not inherently malicious, but in a skill handling arbitrary URLs it increases the chance of unintentional disclosure of sensitive destinations and content to the external provider.
process.exit(1);
}
const resp = await fetch("https://api.tavily.com/extract", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({ api_key: apiKey, urls: [url] }),
The manifest describes an enhanced search and insight engine that can perform sentiment analysis and intelligence summarization. In this file, the code only sends a URL to Tavily's extract endpoint, retrieves raw_content, and prints the first 500 characters without any sentiment analysis, aggregation, or deeper insight processing.
The script transmits user-supplied URLs and the Tavily API key to an external service without explicit user-facing disclosure or consent at runtime. In a skill context, this can expose sensitive internal URLs, targets, or browsing intent to a third party and may surprise users who assume local-only processing.
This finding duplicates the same outbound network behavior: the code makes a POST request to Tavily's external API endpoint. In the context of a URL-extraction skill, third-party transmission is expected, but it still becomes dangerous if users provide confidential URLs or assume processing is local-only.
process.exit(1);
}
const resp = await fetch("https://api.tavily.com/extract", {
method: "POST",
headers: {
"Content-Type": "application/json",
This finding duplicates the same outbound network behavior: the code makes a POST request to Tavily's external API endpoint. In the context of a URL-extraction skill, third-party transmission is expected, but it still becomes dangerous if users provide confidential URLs or assume processing is local-only.
process.exit(1);
}
const resp = await fetch("https://api.tavily.com/extract", {
method: "POST",
headers: {
"Content-Type": "application/json",
The manifest describes an enhanced search and insight engine with analysis capabilities, but this file sends URLs to the Tavily extract endpoint and prints raw extracted content. That is a materially different behavior from search, sentiment analysis, or intelligence summarization, and the code here does not implement the claimed higher-level insight functions.
The script sends both the user's query and the API credential to an external third-party service without any explicit disclosure, consent, or warning at runtime. This can expose sensitive user-entered content to an external processor and may violate user expectations or organizational data-handling policies, especially if queries contain internal, personal, or confidential information.
Several console messages are hard-coded in Chinese, including the primary status and result labels. This creates a language-policy issue because the script imposes a specific locale on all users without opt-in or explanation.
The script transmits user-supplied query data to an external network endpoint, which is expected for a web search tool but still represents a real data egress path. In this context, the main danger is inadvertent disclosure of sensitive or proprietary queries to a third-party service if users are not informed or if no safeguards restrict what may be sent.
console.log(`\n🔍 **正在深潜互联网寻找关于 "${query}" 的答案...**\n`);
const resp = await fetch("https://api.tavily.com/search", {
method: "POST",
headers: {
"Content-Type": "application/json",
The script transmits user-supplied query data to an external network endpoint, which is expected for a web search tool but still represents a real data egress path. In this context, the main danger is inadvertent disclosure of sensitive or proprietary queries to a third-party service if users are not informed or if no safeguards restrict what may be sent.
console.log(`\n🔍 **正在深潜互联网寻找关于 "${query}" 的答案...**\n`);
const resp = await fetch("https://api.tavily.com/search", {
method: "POST",
headers: {
"Content-Type": "application/json",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
process.exit(1);
}
const resp = await fetch("https://api.tavily.com/search", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
process.exit(1);
}
const resp = await fetch("https://api.tavily.com/search", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({
This code transmits the user's supplied query to an external API and includes a credential in the request body, but there is no confirmation prompt, user-facing notice, or explanatory comment/docstring disclosing that data is being sent off-box. For a code file, outbound transmission of user input and credential use should have some visible warning unless clearly disclosed elsewhere in the skill description.
The manifest emphasizes search and insight functions, but this standalone extractor directly reads a secret from process environment state. For a developer-intent audit, credential access is an additional capability not reflected in the skill description itself, even though it is used to call the external service.
The manifest describes an AI search and insight engine with search, sentiment analysis, and intelligence summarization. While network access is expected for a search skill, directly reading a local environment variable for credentials is a separate capability affecting the host environment and is not mentioned in the stated purpose.
The script emits user-facing text in Chinese, and later mixed Chinese/English output, with no option to choose locale or language. That is a natural-language policy issue because it imposes a specific language on all users without documented opt-in or justification.
No suspicious patterns detected.