ClawHub
Back to skill

Security audit

tavily-search-aisa

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly harmful, but it is advertised as Tavily search while the bundled runtime exposes broader AISA search, extraction, and AI synthesis features.

Install only if you want the full AISA multi-search client, not just Tavily search. Avoid sending private URLs, internal documents, secrets, or sensitive prompts through extract, sonar, or verity unless you trust AISA's data handling.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The file is presented as a Tavily-search skill, but its docstring and command set expose materially broader capabilities including scholar search, content extraction, Sonar queries, and multi-source synthesis. This scope mismatch is dangerous because it expands the data egress and operational surface beyond what a reviewer, user, or policy might expect from a narrowly described search skill.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The extract command can fetch and print raw content from arbitrary URLs, which is broader than filtered web search and can be used to exfiltrate or process unexpected external content through the remote API. In the context of a Tavily-search skill, this hidden capability increases risk because it enables content retrieval workflows that users and reviewers may not have consented to.

Context-Inappropriate Capability

High
Confidence
95% confidence
Finding
The Sonar and verity workflows add LLM querying, aggregation, and synthesis behavior unrelated to a Tavily search skill, causing unexpected third-party transmission of user queries and retrieved data. This is dangerous because it broadens both the provider set and the types of processing performed, increasing privacy, compliance, and misuse risks under misleading skill metadata.

Static analysis

No suspicious patterns detected.