ClawHub
Back to skill

Security audit

tavily-extract-aisa

Security checks for vulnerabilities and agentic risk

Overview

This skill is presented as URL extraction, but its bundled runtime also exposes broader search, research, and synthesis commands that send user queries and aggregated results to an external API.

Review this before installing as more than a simple URL extractor. Only use it if you are comfortable with the bundled client being able to send search queries, Sonar prompts, and aggregated search results to AISA endpoints under your AISA_API_KEY, or restrict/remove the extra commands before use.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/search_client.py:116
Finding

Bundled Client Exposes Undeclared Search and Synthesis Capabilities Beyond URL Extraction

Content
View full analysis

Vulnerability Details

File Location: scripts/search_client.py, lines 116–153, 178–269, and 286–337
Vulnerability Type: Excessive functionality and external data transmission beyond the Skill's declared purpose
Risk Level: Medium

The Skill manifest declares only extraction of readable content from user-provided URLs through the Tavily extraction endpoint. However, the canonical runtime client also exposes web search, academic search, hybrid search, Tavily search, Sonar model queries, multi-source retrieval, and AI synthesis.

Relevant code includes:

python
def cmd_web(args: argparse.Namespace) -> None:
    api_key = get_api_key()
    data = aisa_post(api_key, "/scholar/search/web", {
        "query": args.query,
        "max_num_results": args.count,
    })
    print_results(data, "Web Search")


def cmd_scholar(args: argparse.Namespace) -> None:
    api_key = get_api_key()
    body: dict[str, Any] = {
        "query": args.query,
        "max_num_results": args.count,
    }
    if args.year_from:
        body["as_ylo"] = args.year_from
    if args.year_to:
        body["as_yhi"] = args.year_to
    data = aisa_post(api_key, "/scholar/search/scholar", body)
    print_results(data, "Scholar Search")


def cmd_smart(args: argparse.Namespace) -> None:
    api_key = get_api_key()
    data = aisa_post(api_key, "/scholar/search/smart", {
        "query": args.query,
        "max_num_results": args.count,
    })
    print_results(data, "Smart Search")


def cmd_tavily(args: argparse.Namespace) -> None:
    api_key = get_api_key()
    body: dict[str, Any] = {
        "query": args.query,
        "max_results": args.count,
        "search_depth": args.depth,
    }
    if args.topic:
        body["topic"] = args.topic
    if args.time_range:
        body["time_range"] = args.time_range
    if args.include_answer:
        body["include_answer"] = True
    data = 
...[truncated 7050 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the bundled client with an extraction-only implementation exposing only the /tavily/extract operation.
  2. Remove the web, scholar, smart, tavily, sonar, and verity command registrations from this Skill.
  3. Package broader search and synthesis functionality as separate Skills with accurate names, descriptions, permissions, and privacy disclosures.
  4. Document all externally transmitted fields, including URLs, queries, retrieved results, and synthesis payloads.
  5. Require explicit user consent before sending query text or aggregated results to an external service.
  6. Where supported by the service, use API credentials restricted to the extraction endpoint rather than a credential capable of invoking every AISA operation.
  7. Add automated tests that assert the extraction Skill can contact only the fixed AISA origin and the /tavily/extract path.
  8. Add input limits for URL count and response size to reduce accidental credit consumption and resource exhaustion.
  9. Preserve HTTPS certificate validation and avoid allowing runtime overrides of the API origin without an explicit security review.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The documented purpose says the skill only extracts content from user-provided URLs, but the detected behavior indicates a much broader set of capabilities including search, aggregation, synthesis, and external query endpoints. This mismatch is dangerous because users and policy systems may authorize the skill under a narrow trust model while it actually performs broader network actions and data flows.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md
## When NOT to Use

- Do not use this skill for browser-cookie extraction, passwords, Keychain access, or other local sensitive credential access.
- Prefer a different skill when the user request is outside this skill's domain.

## Capabilities

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The file advertises and implements a broad multi-search CLI with multiple outbound search and LLM-related capabilities, while the skill manifest claims the skill is only for Tavily URL extraction. This scope mismatch is dangerous because users, reviewers, and policy controls may grant or trust the skill under narrower assumptions than the code actually enforces, enabling unintended network access and expanded data handling.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The executable entrypoint wires in web, scholar, smart, tavily search, sonar, and verity commands in addition to extract, making the extra capabilities directly reachable at runtime. In an agent-skill setting, hidden or undocumented entrypoints increase risk because they bypass least-privilege expectations and can cause the agent to perform broader external queries than the approved skill purpose suggests.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
81% confidence
Finding

The skill declares access to an environment variable and uses a networked Python client, but it does not define an explicit tool scope such as permissions or allowed-tools. That weakens least-privilege controls and makes it harder for reviewers or runtime policy engines to constrain what the skill can access or invoke.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module documentation explicitly describes a multi-search engine client and lists numerous commands that contradict the manifest's extract-only description. Misleading documentation is security-relevant here because reviewers and operators may approve or invoke the skill under false assumptions about its scope and network behavior.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search_client.py (reported line 28)May include surrounding context.

python
from concurrent.futures import ThreadPoolExecutor, as_completed
from typing import Any

AISA_BASE = "https://api.aisa.one/apis/v1"


def get_api_key() -> str:

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The verity flow performs multi-source retrieval, computes a confidence score, and then sends aggregated results to an explain endpoint for AI synthesis, which goes well beyond simple URL extraction. This is risky in context because it expands data transmission and introduces model-mediated interpretation that users of an extraction skill would not reasonably expect, increasing the chance of unauthorized external processing of retrieved content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This code hard-codes the explanation request language to "en", which imposes a specific language regardless of the user's locale or preference. The policy requires either user opt-in/choice or a clearly justified locale constraint, neither of which is present in this file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest sets the skill language to "en", which indicates an English-only locale constraint. In this file there is no accompanying opt-in, user choice, or justification showing that the skill is intentionally region- or language-specific.

Content

No source excerpt is available for this finding.