ClawHub
Back to skill

Security audit

tavily-search-aisa

Security checks for vulnerabilities and agentic risk

Overview

This skill is presented as Tavily search, but its bundled runtime exposes broader search, extraction, model-query, aggregation, and synthesis features that are not clearly disclosed.

Review before installing. Only use this skill if you are comfortable giving it an AISA API key and having queries, URLs, and search results sent to api.aisa.one. Treat the bundled script as broader than a Tavily-only search tool unless the extra commands are removed or fully documented.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

other

Warning
Location
scripts/search_client.py:201
Finding

Undeclared Network Capabilities and Excessive External Data Disclosure

Content
View full analysis
str: key = os.environ.get("AISA_API_KEY", "") if not key: print("Error: AISA_API_KEY environment variable is not set.", file=sys.stderr) print("Get your key at https://aisa.one", file=sys.stderr) sys.exit(1) return key def aisa_post(api_key: str, path: str, body: dict[str, Any]) -> dict[str, Any]: url = f"{AISA_BASE}{path}" data = json.dumps(body).encode() req = urllib.request.Request( url, data=data, headers={ "Authorization": f"Bearer {api_key}", "Conte ...[truncated 7065 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared purpose presents the skill as a Tavily web-search wrapper, but the detected behavior includes broader search, extraction, model-querying, aggregation, and synthesis capabilities. This mismatch is dangerous because operators may approve or invoke the skill under a narrower trust model while it can access and process content in materially different ways, increasing the chance of misuse, data overcollection, or policy bypass.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md
## When NOT to Use

- Do not use this skill for browser-cookie extraction, passwords, Keychain access, or other local sensitive credential access.
- Prefer a different skill when the user request is outside this skill's domain.

## Capabilities

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The file implements substantially broader functionality than the skill metadata describes, including scholar search, smart search, sonar queries, extraction, and synthesis. This capability mismatch is dangerous because users, reviewers, or policy controls may trust the skill as a narrow Tavily-search tool while it can transmit prompts and retrieved data to additional external endpoints and perform actions outside the declared scope.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill performs URL extraction through /tavily/extract, which is materially different from simple web search. Extraction can retrieve and expose raw page contents from attacker-chosen URLs, increasing data handling and external access beyond the declared search-only purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The multi-source verity flow adds parallel querying of multiple services plus a synthesis step that sends aggregated results to another endpoint for summarization. This expands both the data-sharing surface and the operational scope beyond the stated Tavily-search function, creating risk of unintended data transmission and misleading trust boundaries.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill declares access to an API key and uses networked code paths, but it does not define an explicit tool scope such as allowed tools or permissions. This creates an authorization gap where the runtime may permit broader execution or network behavior than reviewers and users expect, reducing containment if the skill is repurposed or modified.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search_client.py (reported line 28)May include surrounding context.

python
from concurrent.futures import ThreadPoolExecutor, as_completed
from typing import Any

AISA_BASE = "https://api.aisa.one/apis/v1"


def get_api_key() -> str:

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
78% confidence
Finding

The manifest only describes Tavily search functionality and does not mention credential handling, while the code accesses AISA_API_KEY from the environment. Although common in implementation terms, this is an additional sensitive capability not declared in the stated skill purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The code hard-codes the explain request language to "en", which imposes a specific language/locale on users. This matches the policy category for language or locale constraints because the skill does not offer an opt-in, configuration option, or justification for restricting output to English.

Content

No source excerpt is available for this finding.