Turing Tavily Web Search

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:01 AM UTC
• Version: 1.0.0

Overview

This web-search skill does what it says, but it can send the user's search text and Turing bearer token to any configured API base without validating the destination.

Review the configured TURING_API_BASE before installing or using this skill. Use only a trusted HTTPS Turing proxy endpoint, treat search queries as data sent to that service, and prefer a narrowly scoped Turing token because the script forwards the bearer token and client/environment metadata with each search request.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts.py:27

Finding

Configurable API Endpoint Can Expose Credentials and Search Queries

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill documentation indicates it invokes a bundled script that performs web search through a remote proxy API, which is a network-capable action, but the skill declares no explicit tool scope such as permissions or allowed-tools. This creates a policy gap: agents or reviewers cannot reliably constrain or reason about the skill's external communication behavior, increasing the risk of unintended data egress or misuse of network access.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts.py (reported line 39)May include surrounding context.

python

"User-Agent": "openclaw-tavily-web-search",
    }

    response = requests.post(url, json=request_body, headers=headers, timeout=30)
    response.raise_for_status()
    data = response.json()

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script sends the user-provided query in an HTTP POST request and includes an API bearer token plus client/environment identifiers in headers. While the function names imply search behavior, there is no confirmation prompt or explicit user-facing disclosure near execution that input data will be sent to a remote service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The script reads TURING_API_KEY and related values from a local configuration source and uses them to authenticate outbound requests. Although this is functionally necessary, the code provides no explicit disclosure that credentials are being read from disk and used to contact an external service.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.