ClawHub
Back to skill

Security audit

Extract

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Tavily URL extraction helper, with the main risk being that submitted URLs and query text are sent to Tavily.

Install only if you are comfortable sending the URLs you provide, optional query text, and extraction settings to Tavily. Avoid using it for private intranet pages, credential-bearing URLs, regulated data, or confidential research targets unless your organization approves Tavily for that use.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (14)

Agent Config Directory Access

High
Category
Agent Snooping
Content
**Tavily API Key Required** - Get your key at https://tavily.com

Add to `~/.claude/settings.json`:
```json
{
  "env": {
Confidence
90% confidence
Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill documents shell execution (`./scripts/extract.sh` and `curl`) but does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch weakens policy enforcement and increases the chance an agent can invoke shell capabilities without clear user-visible restriction or review.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The description says the skill extracts content from URLs but does not warn that the user-supplied URLs and optional query text are transmitted to Tavily, a third-party service. This can cause unintended disclosure of sensitive URLs, internal document locations, or confidential search context because users may assume processing is local.

External Transmission

Medium
Category
Data Exfiltration
Content
### Basic Extraction

```bash
curl --request POST \
  --url https://api.tavily.com/extract \
  --header "Authorization: Bearer $TAVILY_API_KEY" \
  --header 'Content-Type: application/json' \
Confidence
96% confidence
Finding
This example sends user-provided URLs to `https://api.tavily.com/extract` along with an authorization token. External transmission is inherent to the skill's function, but it is still a real data-flow risk because arbitrary URLs and extraction context may include private or sensitive information.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
curl --request POST \
  --url https://api.tavily.com/extract \
  --header "Authorization: Bearer $TAVILY_API_KEY" \
  --header 'Content-Type: application/json' \
  --data '{
Confidence
94% confidence
Finding
The documented API endpoint is an external network destination, confirming that the skill causes data to leave the local environment. In context this is intentional, but it remains security-relevant because the skill has no strong guardrails or warnings around what data is appropriate to transmit.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
curl --request POST \
  --url https://api.tavily.com/extract \
  --header "Authorization: Bearer $TAVILY_API_KEY" \
  --header 'Content-Type: application/json' \
  --data '{
Confidence
94% confidence
Finding
This example sends multiple URLs and a query string to Tavily, increasing the volume and sensitivity of externally transmitted data. Query text can reveal investigative intent, internal terminology, or confidential subjects in addition to the URLs themselves.

External Transmission

Medium
Category
Data Exfiltration
Content
### Endpoint

```
POST https://api.tavily.com/extract
```

### Headers
Confidence
91% confidence
Finding
The endpoint declaration explicitly indicates use of a third-party extraction service. While not malicious, this matters because users may not realize the skill's core operation depends on external data transfer and third-party processing.

External Transmission

Medium
Category
Data Exfiltration
Content
### Single URL Extraction

```bash
curl --request POST \
  --url https://api.tavily.com/extract \
  --header "Authorization: Bearer $TAVILY_API_KEY" \
  --header 'Content-Type: application/json' \
Confidence
96% confidence
Finding
This example again demonstrates outbound transmission of extraction targets and parameters to Tavily's external API. Even though it is expected behavior, it creates confidentiality and compliance risk if users submit sensitive URLs or content sources without understanding the third-party exposure.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
curl --request POST \
  --url https://api.tavily.com/extract \
  --header "Authorization: Bearer $TAVILY_API_KEY" \
  --header 'Content-Type: application/json' \
  --data '{
Confidence
94% confidence
Finding
This single-URL extraction example again demonstrates external submission of user-selected targets to Tavily. The risk is contextual rather than exploit-driven: if used on private URLs, staging systems, or intranet resources, metadata about those resources may be disclosed to the third party.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
curl --request POST \
  --url https://api.tavily.com/extract \
  --header "Authorization: Bearer $TAVILY_API_KEY" \
  --header 'Content-Type: application/json' \
  --data '{
Confidence
95% confidence
Finding
The targeted extraction example sends both URLs and a relevance query to Tavily, which may expose sensitive business context or research topics. Because the skill encourages query-focused extraction, the surrounding context can become more revealing than raw URL submission alone.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
curl --request POST \
  --url https://api.tavily.com/extract \
  --header "Authorization: Bearer $TAVILY_API_KEY" \
  --header 'Content-Type: application/json' \
  --data '{
Confidence
93% confidence
Finding
The advanced extraction example may cause external processing of richer, dynamic page content and wait longer for retrieval, potentially increasing the amount of collected data. That makes the external-transmission risk somewhat stronger in context because more complete page content can be exposed to the third party.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
curl --request POST \
  --url https://api.tavily.com/extract \
  --header "Authorization: Bearer $TAVILY_API_KEY" \
  --header 'Content-Type: application/json' \
  --data '{
Confidence
93% confidence
Finding
The batch extraction example encourages transmitting multiple URLs in one request, amplifying the confidentiality impact of any mistaken or unauthorized use. A single action could disclose a broad set of targets or research interests to the external provider.

External Transmission

Medium
Category
Data Exfiltration
Content
exit 1
fi

curl -s --request POST \
    --url https://api.tavily.com/extract \
    --header "Authorization: Bearer $TAVILY_API_KEY" \
    --header 'Content-Type: application/json' \
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
fi

curl -s --request POST \
    --url https://api.tavily.com/extract \
    --header "Authorization: Bearer $TAVILY_API_KEY" \
    --header 'Content-Type: application/json' \
    --header 'x-client-source: claude-code-skill' \
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.