Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Tavily URL extraction helper, with the main risk being that submitted URLs and query text are sent to Tavily.
Install only if you are comfortable sending the URLs you provide, optional query text, and extraction settings to Tavily. Avoid using it for private intranet pages, credential-bearing URLs, regulated data, or confidential research targets unless your organization approves Tavily for that use.
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Tavily API Key Required - Get your key at https://tavily.com
Add to ~/.claude/settings.json:
{
"env": {
The skill documents shell execution (./scripts/extract.sh and curl) but does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch weakens policy enforcement and increases the chance an agent can invoke shell capabilities without clear user-visible restriction or review.
The description says the skill extracts content from URLs but does not warn that the user-supplied URLs and optional query text are transmitted to Tavily, a third-party service. This can cause unintended disclosure of sensitive URLs, internal document locations, or confidential search context because users may assume processing is local.
This example sends user-provided URLs to https://api.tavily.com/extract along with an authorization token. External transmission is inherent to the skill's function, but it is still a real data-flow risk because arbitrary URLs and extraction context may include private or sensitive information.
curl --request POST \
--url https://api.tavily.com/extract \
--header "Authorization: Bearer $TAVILY_API_KEY" \
--header 'Content-Type: application/json' \
The documented API endpoint is an external network destination, confirming that the skill causes data to leave the local environment. In context this is intentional, but it remains security-relevant because the skill has no strong guardrails or warnings around what data is appropriate to transmit.
curl --request POST \
--url https://api.tavily.com/extract \
--header "Authorization: Bearer $TAVILY_API_KEY" \
--header 'Content-Type: application/json' \
--data '{
This example sends multiple URLs and a query string to Tavily, increasing the volume and sensitivity of externally transmitted data. Query text can reveal investigative intent, internal terminology, or confidential subjects in addition to the URLs themselves.
curl --request POST \
--url https://api.tavily.com/extract \
--header "Authorization: Bearer $TAVILY_API_KEY" \
--header 'Content-Type: application/json' \
--data '{
The endpoint declaration explicitly indicates use of a third-party extraction service. While not malicious, this matters because users may not realize the skill's core operation depends on external data transfer and third-party processing.
POST https://api.tavily.com/extract
This example again demonstrates outbound transmission of extraction targets and parameters to Tavily's external API. Even though it is expected behavior, it creates confidentiality and compliance risk if users submit sensitive URLs or content sources without understanding the third-party exposure.
curl --request POST \
--url https://api.tavily.com/extract \
--header "Authorization: Bearer $TAVILY_API_KEY" \
--header 'Content-Type: application/json' \
This single-URL extraction example again demonstrates external submission of user-selected targets to Tavily. The risk is contextual rather than exploit-driven: if used on private URLs, staging systems, or intranet resources, metadata about those resources may be disclosed to the third party.
curl --request POST \
--url https://api.tavily.com/extract \
--header "Authorization: Bearer $TAVILY_API_KEY" \
--header 'Content-Type: application/json' \
--data '{
The targeted extraction example sends both URLs and a relevance query to Tavily, which may expose sensitive business context or research topics. Because the skill encourages query-focused extraction, the surrounding context can become more revealing than raw URL submission alone.
curl --request POST \
--url https://api.tavily.com/extract \
--header "Authorization: Bearer $TAVILY_API_KEY" \
--header 'Content-Type: application/json' \
--data '{
The advanced extraction example may cause external processing of richer, dynamic page content and wait longer for retrieval, potentially increasing the amount of collected data. That makes the external-transmission risk somewhat stronger in context because more complete page content can be exposed to the third party.
curl --request POST \
--url https://api.tavily.com/extract \
--header "Authorization: Bearer $TAVILY_API_KEY" \
--header 'Content-Type: application/json' \
--data '{
The batch extraction example encourages transmitting multiple URLs in one request, amplifying the confidentiality impact of any mistaken or unauthorized use. A single action could disclose a broad set of targets or research interests to the external provider.
curl --request POST \
--url https://api.tavily.com/extract \
--header "Authorization: Bearer $TAVILY_API_KEY" \
--header 'Content-Type: application/json' \
--data '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
exit 1
fi
curl -s --request POST \
--url https://api.tavily.com/extract \
--header "Authorization: Bearer $TAVILY_API_KEY" \
--header 'Content-Type: application/json' \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
fi
curl -s --request POST \
--url https://api.tavily.com/extract \
--header "Authorization: Bearer $TAVILY_API_KEY" \
--header 'Content-Type: application/json' \
--header 'x-client-source: claude-code-skill' \