Chen Tavily Search

• Analyzed: May 10, 2026, 6:38 AM
• Findings: 1
• Version: 1.0.0
• Hash: 6c15c2f32e1214ca2ea2915df71d4b6270c7b457104eb0c160cbc88262ce36ae
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains a hardcoded Tavily API key (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) exposed within the SKILL.md documentation and the _meta.json metadata fields. While the core logic in scripts/search.mjs is a functional wrapper for the Tavily API and lacks evidence of intentional malice or data exfiltration, the inclusion of active credentials constitutes a significant security vulnerability and improper secret management.