T09 · Insecure Skill Coding Practices
Warning
- Location
tavily-search.sh:69- Finding
Tavily API Key Exposed Through Process Arguments
- Content
View full analysis
- Remediation
View remediation
Security audit
Tavily Skill.Bak
Security checks for vulnerabilities and agentic risk
Overview
This is a straightforward Tavily web-search skill with expected external API calls, but users should protect the API key and avoid sensitive search queries.
Install only if you are comfortable sending search queries to Tavily. Do not use it for secrets, confidential internal topics, private URLs, or regulated data. Store the Tavily API key carefully, do not print it with echo, and rotate it if it appears in logs, terminal recordings, screenshots, or shared support output.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
SKILL.md:110- Finding
Troubleshooting Documentation Instructs Users to Print the API Key
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (11)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill clearly instructs use of shell commands (
curl,jq) but does not declare any tool scope such aspermissionsorallowed-tools. This weakens execution boundaries and can cause an agent framework to invoke shell access more broadly than intended, increasing the risk of unauthorized command execution or unsafe composition with other inputs.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill is designed to send user search queries to Tavily and can optionally request raw page content, but it does not warn that user-provided data and retrieved content are transmitted to a third-party service. This creates a privacy and data-governance risk, especially if users include sensitive, proprietary, or regulated information in queries.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 92% confidence
- Finding
This example performs an authenticated POST request to Tavily, transmitting the user's query to an external service. In context this is expected functionality for a web-search skill, but it is still security-relevant because it exports user input and uses a bearer token that could be mishandled in logs, transcripts, or downstream tooling.
- Content
Basic Search
bash # Search for a topic curl -X POST "https://api.tavily.com/search" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $TAVILY_API_KEY" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 92% confidence
- Finding
This example performs an authenticated POST request to Tavily, transmitting the user's query to an external service. In context this is expected functionality for a web-search skill, but it is still security-relevant because it exports user input and uses a bearer token that could be mishandled in logs, transcripts, or downstream tooling.
- Content
Basic Search
bash # Search for a topic curl -X POST "https://api.tavily.com/search" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $TAVILY_API_KEY" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
This research example sends a more detailed query and may request enhanced response features from Tavily, increasing the amount of user-derived data shared with a third party. The context makes the transmission intentional, but the richer research workflow can amplify privacy exposure if users submit internal research topics or confidential prompts.
- Content
Research Query
bash # Get detailed research results curl -X POST "https://api.tavily.com/search" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $TAVILY_API_KEY" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
This research example sends a more detailed query and may request enhanced response features from Tavily, increasing the amount of user-derived data shared with a third party. The context makes the transmission intentional, but the richer research workflow can amplify privacy exposure if users submit internal research topics or confidential prompts.
- Content
Research Query
bash # Get detailed research results curl -X POST "https://api.tavily.com/search" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $TAVILY_API_KEY" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
This news-search example also transmits user queries and an API credential to Tavily over the network. Although normal for this skill, it remains a true external-transmission risk because user requests leave the local environment and may be subject to third-party retention, monitoring, or policy constraints.
- Content
News Search
bash # Search for recent news curl -X POST "https://api.tavily.com/search" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $TAVILY_API_KEY" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
This news-search example also transmits user queries and an API credential to Tavily over the network. Although normal for this skill, it remains a true external-transmission risk because user requests leave the local environment and may be subject to third-party retention, monitoring, or policy constraints.
- Content
News Search
bash # Search for recent news curl -X POST "https://api.tavily.com/search" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $TAVILY_API_KEY" \ -d '{
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script sends the user-supplied query to Tavily's external API but does not warn the user that potentially sensitive search content will leave the local environment. In an agent-skill context, users may assume inputs are processed locally, so secrets, internal URLs, or proprietary research terms could be unintentionally disclosed to a third party.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
This curl call transmits user input and an API credential to an external service, creating a real data egress path. While expected for a web-search skill, it still becomes a security issue if the skill can be invoked on sensitive prompts without clear consent, because internal data may be exfiltrated to a third-party API.
- Content
sh fi # Make API request curl -s -X POST "https://api.tavily.com/search" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $TAVILY_API_KEY" \ -d "{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
This curl call transmits user input and an API credential to an external service, creating a real data egress path. While expected for a web-search skill, it still becomes a security issue if the skill can be invoked on sensitive prompts without clear consent, because internal data may be exfiltrated to a third-party API.
- Content
sh fi # Make API request curl -s -X POST "https://api.tavily.com/search" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $TAVILY_API_KEY" \ -d "{
Static analysis
No suspicious patterns detected.