Security audit

tavily-extract-aisa

Security checks for vulnerabilities and agentic risk

Overview

This skill is framed as a URL extraction tool, but its bundled runtime also exposes broader search, research, and synthesis commands that send user inputs to AISA APIs.

Install only if you are comfortable treating this as a broader AISA search and research client, not just a Tavily extraction skill. Avoid using private URLs, sensitive queries, or confidential research material unless you trust AISA with that data and intend to use the broader commands.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill declares no explicit permissions while requiring an API key and making networked requests, which hides its effective capability surface from reviewers and policy controls. This is dangerous because under-declared permissions reduce transparency and can allow a seemingly simple content-extraction skill to access secrets and external services without clear operator awareness.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented purpose is extract-only, but the referenced runtime behavior appears to support broad search, multi-source retrieval, model querying, and synthesis endpoints beyond user-provided URL extraction. This mismatch is dangerous because it can mislead users and security reviewers, enabling unexpected data egress, broader internet interaction, or invocation of more powerful capabilities than consented to.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: Pointing the primary runtime to a search client in an extract-only skill strongly suggests the packaged runtime is inconsistent with the documented function. This is dangerous because operators may invoke a broader tool than intended, potentially causing unexpected searches, external data transfers, or misuse of the provided API key.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The file’s declared skill is narrowly scoped to Tavily URL extraction, but the implementation is a general-purpose multi-search and research client with web, scholar, smart, tavily, sonar, and synthesis features. This scope expansion increases the available attack surface and permits networked actions and data flows unrelated to the advertised skill, which is risky in agent environments that rely on least privilege and accurate capability descriptions.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The CLI registration exposes commands for broad search, deep research, and synthesis that are unrelated to simple URL content extraction. In an agent skill ecosystem, this mismatch can let a caller invoke unexpected capabilities, causing unauthorized external queries or AI-generated synthesis beyond the user’s intended action.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: The verity workflow performs parallel retrieval across multiple external sources and then submits aggregated results to an explanation endpoint for synthesis. This materially exceeds the stated extraction purpose and can transmit user queries and retrieved content to multiple third-party-backed services, creating privacy, compliance, and capability-creep risks.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The helper sends user-provided queries and URLs to a remote API service, but the code provides no user-facing disclosure or consent mechanism before transmitting potentially sensitive inputs. In agent contexts, silent external transmission is dangerous because users may assume local-only processing while their URLs, queries, and extracted content are sent off-box.

Static analysis

No suspicious patterns detected.