Tavily Crawl

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:26 PM UTC
• Version: 1.0.0

Overview

The skill is for crawling websites, but it automatically uses local Tavily credentials and may download and run an unpinned npm OAuth helper, so it needs review before installation.

Install only if you are comfortable sending crawl targets and instructions to Tavily and letting the skill use Tavily credentials from local auth/config files. Prefer setting a scoped `TAVILY_API_KEY` only for the command, avoid crawling private/internal sites unless approved, and review or pin the `mcp-remote` OAuth helper before first use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/crawl.sh:105

Finding

Automatic Execution of an Unpinned npm Package

Content

View full analysis

&2 echo "Please complete authentication in your browser..." >&2 npx -y mcp-remote https://mcp.tavily.com/mcp /dev/null 2>&1 & MCP_PID=$! ``` ### Technical Analysis When no Tavily credential is available, the script invokes `npx -y mcp-remote` without specifying an exact package version or validating package integrity. The `-y` option suppresses the normal installation confirmation. Consequently, npm may download and execute whichever version of `mcp-remote` is currently resolved by the configured registry. The effective executable code is therefore not contained in, pinned by, or auditable from this project. A compromised package release, npm maintainer account, transitive dependency, package registry, or local npm registry configuration could cause arbitrary code to execute during authentication. This behavior is triggered automatically as part of the documented first-run workflow. ### Attack Path 1. The user invokes `scripts/crawl.sh` without setting `TAVILY_API_KEY`, and no acceptable cached Tavily token is found. 2. The script reaches the OAuth branch. 3. `npx -y` resolves and, if necessary, downloads the current `mcp-remote` package and its dependencies. 4. npm executes package-controlled code without interactive confirmation. 5. If the resolved package or dependency is malicious or compromised, that code executes with the permissions and environment of the user running the Skill. 6. The malicious code may access files, credentials, environment variables, or network resources available to that user. ### Impact Assessment Successful exploitation provides arbitrary code execution with the invoking user's privileges. The ...[truncated 302 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/crawl.sh:195

Finding

Predictable Output Files Can Be Overwritten Through Symlinks or Filename Collisions

Content

View full analysis

"$FILEPATH" echo "" >> "$FILEPATH" echo "$CONTENT" >> "$FILEPATH" echo "Saved: $FILEPATH" ``` ### Technical Analysis The script deterministically derives each output filename from the returned page URL and writes to it using shell redirection with the truncating `>` operator. It does not verify that the destination is a new regular file, reject symbolic links, or use exclusive and atomic file creation. Shell redirection follows symbolic links. If another local actor can prepare the selected output directory, that actor can create a symlink using a predictable crawl filename and point it to another file writable by the victim. When the relevant URL is returned, the first redirection truncates the symlink target and replaces its contents with crawl output. The filename transformation also truncates names to 100 characters and maps several distinct URL characters to underscores. Different URLs can therefore produce the same filename, causing pages from the same crawl to overwrite one another even without an attacker. ### Attack Path 1. An attacker learns or predicts a URL that the user will crawl and applies the script's public filename transformation to it. 2. The attacker requires write access to the chosen output directory, or otherwise causes the user to select an attacker-prepared directory. 3. The attacker creates the expected `.md` output path as a symbolic link to another file writable by the user. 4. Tavily returns a result whose URL maps to that filename. 5. The command `echo "# $PAGE_URL" > "$FILEPATH"` ...[truncated 851 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared purpose says the skill simply crawls a website from a URL, but the content reveals additional sensitive behaviors: reading local auth material, triggering OAuth in a browser, using a third-party remote service, and accepting broader operational parameters. This mismatch can mislead users and agents into approving or invoking the skill without understanding data exposure, credential use, and external dependencies.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

The skill instructs users to place a third-party API key into the agent configuration file at ~/.claude/settings.json, a sensitive configuration location that may be shared across skills or accessible to broader agent tooling. This expands credential exposure risk and couples the skill to privileged local configuration rather than a dedicated secret-management path.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

Alternative: API Key

If you prefer using an API key, get one at https://tavily.com and add to ~/.claude/settings.json:

json

{
  "env": {

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill invokes shell-based behavior but does not declare a tool scope such as permissions or allowed-tools, which weakens reviewability and enforcement of what the skill may execute. In an agent environment, undeclared shell capability increases the chance of unexpected command execution, filesystem access, or network use beyond what a user would infer from the metadata.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The activation wording is broad enough to match many common requests involving websites, documentation, offline analysis, or downloading content. Over-broad triggering can cause the agent to select a networked, file-writing skill in situations where the user did not intend external transmission or local persistence.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation does not prominently warn that user-supplied URLs and retrieved page content are sent to an external Tavily service and may also be stored as local markdown files. In a security-sensitive agent context, missing disclosure increases the risk of accidental exfiltration of proprietary URLs, sensitive content, or regulated data.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

Basic Crawl

bash

curl --request POST \
  --url https://api.tavily.com/crawl \
  --header "Authorization: Bearer $TAVILY_API_KEY" \
  --header 'Content-Type: application/json' \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

Basic Crawl

bash

curl --request POST \
  --url https://api.tavily.com/crawl \
  --header "Authorization: Bearer $TAVILY_API_KEY" \
  --header 'Content-Type: application/json' \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

bash

curl --request POST \
  --url https://api.tavily.com/crawl \
  --header "Authorization: Bearer $TAVILY_API_KEY" \
  --header 'Content-Type: application/json' \
  --data '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

bash

curl --request POST \
  --url https://api.tavily.com/crawl \
  --header "Authorization: Bearer $TAVILY_API_KEY" \
  --header 'Content-Type: application/json' \
  --data '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

bash

curl --request POST \
  --url https://api.tavily.com/crawl \
  --header "Authorization: Bearer $TAVILY_API_KEY" \
  --header 'Content-Type: application/json' \
  --data '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.

bash

curl --request POST \
  --url https://api.tavily.com/crawl \
  --header "Authorization: Bearer $TAVILY_API_KEY" \
  --header 'Content-Type: application/json' \
  --data '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.

bash

curl --request POST \
  --url https://api.tavily.com/crawl \
  --header "Authorization: Bearer $TAVILY_API_KEY" \
  --header 'Content-Type: application/json' \
  --data '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 193)May include surrounding context.

bash

curl --request POST \
  --url https://api.tavily.com/crawl \
  --header "Authorization: Bearer $TAVILY_API_KEY" \
  --header 'Content-Type: application/json' \
  --data '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 213)May include surrounding context.

bash

curl --request POST \
  --url https://api.tavily.com/crawl \
  --header "Authorization: Bearer $TAVILY_API_KEY" \
  --header 'Content-Type: application/json' \
  --data '{

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This skill goes beyond crawling a website by recursively searching ~/.mcp-auth for cached OAuth tokens and, if none are found, launching an OAuth process to obtain new credentials. Accessing local credential stores and initiating authentication flows increases sensitivity because the skill can silently consume secrets unrelated to the immediate user request.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script reads cached MCP OAuth access tokens from the user's home directory without clearly disclosing that sensitive local credentials will be inspected and reused. Even if the tokens are only used for Tavily, undisclosed secret access violates least surprise and can expose users to unintended credential use in an otherwise simple 'crawl a URL' skill.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The script executes npx -y mcp-remote without pinning a specific package version or integrity hash, so a future malicious or compromised release could run arbitrary code during the OAuth helper flow. Because this helper is invoked automatically when no API key is present, the attack surface is reachable in normal use and could lead to code execution under the user's account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script transmits the provided URL and crawl arguments to Tavily's remote service, but the help text does not clearly warn users that their targets and instructions leave the local system. This matters because crawl targets, path filters, or semantic instructions may contain sensitive internal URLs, documentation locations, or confidential investigation context.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/crawl.sh (reported line 168)May include surrounding context.

sh

}')

# Call Tavily MCP server via HTTPS (SSE response)
RESPONSE=$(curl -s --request POST \
    --url "https://mcp.tavily.com/mcp" \
    --header "Authorization: Bearer $TAVILY_API_KEY" \
    --header 'Content-Type: application/json' \

Static analysis

No suspicious patterns detected.