Back to skill

Security audit

tavily-search-zh

Security checks for vulnerabilities and agentic risk

Overview

This Tavily search skill includes a broader remote search and extraction client than its user-facing description clearly discloses.

Review this skill before installing. It is not limited to the Tavily search behavior described in SKILL.md: the included client can use your AISA_API_KEY for other AISA routes, including URL extraction, Sonar/Perplexity-style prompts, scholar/web/smart searches, and multi-source synthesis. Avoid submitting secrets, private URLs, or sensitive internal queries unless the broader remote processing is acceptable.

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/search_client.py:102
Finding

Bundled Client Exceeds the Skill's Declared Tavily-Only Scope

Content
View full analysis
None: api_key = get_api_key() urls = [u.strip() for u in args.urls.split(",")] data = aisa_post(api_key, "/tavily/extract", {"urls": urls}) if "results" in data and isinstance(data["results"], list): for r in data["results"]: print(f"\n{'='*60}") print(f" URL: {r.get('url', 'Unknown')}") print(f"{'='*60}") content = r.get("raw_content", "") print(content[:3000] if content else "(no content)") else: print(json.dumps(data, indent=2)) def cmd_sonar(args: argparse.Namespace) -> None: api_key = get_api_key() endpoint_map = { "sonar": "/sonar", "sonar-pro": "/sonar-pro", "sonar-reasoning-pro": "/sonar-reasoning-pro", "sonar-deep-research": "/sonar-deep-research", } endpoint = endpoint_map.get(args.model, "/sonar") data = aisa_post(api_key, endpoint, { "model": args.model, "messages": [{"role": "user", "content": args.query}], }) print_results(data, f"Perplexity ({args.model})") def cmd_verity(args: argp ...[truncated 6469 chars]
Remediation
View remediation
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared purpose says the skill only performs Tavily web search with filtering, but the analyzed behavior indicates additional capabilities such as URL extraction, other search modes, model invocation, multi-source retrieval, and explanation endpoints. This hidden capability expansion is dangerous because users and orchestrators may invoke the skill under a narrower trust model than its real behavior, enabling unexpected data flows, external calls, or prompt-handling surfaces.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The file advertises and implements a broad multi-engine client (web, scholar, smart, Tavily, extract, sonar, verity) while the skill metadata describes a Tavily-only search capability. This scope mismatch is dangerous because an agent or reviewer may authorize the skill expecting limited Tavily web search, but the code can transmit user data to additional services and perform materially different operations than declared.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
94% confidence
Finding

The Sonar/Perplexity querying capability sends user prompts to model endpoints unrelated to the stated Tavily search purpose. In this context, undeclared LLM querying is risky because it exposes user input to additional remote processing and enables capabilities beyond approved search behavior, undermining least privilege and informed consent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The verity flow performs parallel multi-source querying, confidence scoring, and AI synthesis across several endpoints, which substantially exceeds a simple Tavily search skill. This is dangerous because it broadens data sharing, increases unintended external processing, and changes the trust and privacy profile of the skill without corresponding disclosure.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding

The skill declares access to an API key and performs networked operations, but it does not define an explicit tool scope such as allowed-tools or permissions. This creates ambiguity about what runtime capabilities the skill may exercise and weakens least-privilege controls, making misuse or unexpected outbound access harder to govern.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

L03 将触发条件描述为“当用户需要比普通关键词搜索更灵活的网页检索过滤能力时使用”,这是能力导向的宽泛表述,而不是明确的触发短语或边界条件。虽然文档包含部分不适用场景,但仍未给出足够具体的触发示例、限定词或负例来区分何时应调用该 skill,容易与一般网页搜索请求重叠。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

L27 重复了与 L03 相同的宽泛触发条件,仅说明在“需要比普通关键词搜索更灵活的网页检索过滤能力”时使用,但没有明确限定必须使用 Tavily 特有过滤项、哪些请求属于普通搜索、以及哪些表达不应触发。该描述可能覆盖大量日常搜索表述,存在意外调用风险。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest sets the skill language to "zh", which indicates a fixed language/locale choice. There is no surrounding indication in this file that users can opt into another language or that the restriction is justified by a region-specific purpose.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search_client.py (reported line 28)May include surrounding context.

python
from concurrent.futures import ThreadPoolExecutor, as_completed
from typing import Any

AISA_BASE = "https://api.aisa.one/apis/v1"


def get_api_key() -> str:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The client transmits user queries and user-supplied URLs to remote API endpoints without any explicit privacy warning or consent prompt. In a search skill this may be operationally necessary, but it is still a real privacy issue because users may provide sensitive terms or internal URLs without understanding that the data is leaving the local environment and being processed by a third party.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The extract command accepts arbitrary URLs and sends them to a remote extraction endpoint, but this capability is not described in the manifest. Hidden extraction features increase risk because users may unknowingly cause sensitive internal or private links to be fetched and processed by a third party outside the expected Tavily search-only scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The explain request sets "language": "en", which forces English output regardless of user preference. This is a natural-language policy concern because the file does not provide an opt-in, configuration flag, or justification for restricting output to a single language.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.