ClawHub
Back to skill

Security audit

Tavily Crawl

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real Tavily website-crawling skill, but it needs review because it can automatically use local OAuth tokens and launch an unpinned npm OAuth helper.

Install only if you are comfortable with Tavily receiving crawl targets, crawl options, and semantic instructions, and with the skill using local Tavily OAuth state. Prefer setting `TAVILY_API_KEY` explicitly, avoid internal or regulated sites unless approved, keep crawl limits narrow, and review any saved markdown before feeding it into another agent.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill advertises and documents shell-based execution (`./scripts/crawl.sh`, `curl`) but does not declare the corresponding permissions. This creates a transparency and consent gap: users or hosting platforms may not realize the skill can invoke shell commands, perform network operations, and write files locally.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The script automatically launches an external OAuth flow via `npx mcp-remote` when no API key is present, which is a materially broader capability than simple crawling. This can trigger unexpected network activity, browser-based authentication, and implicit credential acquisition from the local environment, increasing the risk of surprise auth actions and unintended account linkage.

Intent-Code Divergence

Low
Confidence
80% confidence
Finding
The skill description says 'No code required - just provide a URL,' but the implementation may perform authentication setup and launch external tooling before crawling. This mismatch weakens informed consent and can mislead users about the skill's true behavior, especially in restricted or privacy-sensitive environments.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The description says the skill can crawl websites and save pages locally, but it does not clearly warn that requested URLs and retrieved content are sent to Tavily, a third-party service, and may also be stored on disk. This is dangerous because users may submit sensitive internal URLs, documentation, or proprietary content without informed consent about external disclosure and local persistence.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script scans `$HOME/.mcp-auth` and reuses access tokens from local cache files without prompting the user or disclosing that stored credentials will be searched. Silent credential discovery is risky because it expands the skill's access beyond the provided input and may use tokens the user did not intend to expose to this skill.

External Transmission

Medium
Category
Data Exfiltration
Content
### Basic Crawl

```bash
curl --request POST \
  --url https://api.tavily.com/crawl \
  --header "Authorization: Bearer $TAVILY_API_KEY" \
  --header 'Content-Type: application/json' \
Confidence
94% confidence
Finding
curl --request POST \ --url https://api.tavily.com/crawl \ --header "Authorization: Bearer $TAVILY_API_KEY" \ --header 'Content-Type: application/json' \ --data '{ "url": "https://docs.exa

External Transmission

Medium
Category
Data Exfiltration
Content
Use when feeding crawl results into an LLM context:

```bash
curl --request POST \
  --url https://api.tavily.com/crawl \
  --header "Authorization: Bearer $TAVILY_API_KEY" \
  --header 'Content-Type: application/json' \
Confidence
94% confidence
Finding
curl --request POST \ --url https://api.tavily.com/crawl \ --header "Authorization: Bearer $TAVILY_API_KEY" \ --header 'Content-Type: application/json' \ --data '{ "url": "https://docs.exa

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
curl --request POST \
  --url https://api.tavily.com/crawl \
  --header "Authorization: Bearer $TAVILY_API_KEY" \
  --header 'Content-Type: application/json' \
  --data '{
Confidence
92% confidence
Finding
https://api.tavily.com/

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
curl --request POST \
  --url https://api.tavily.com/crawl \
  --header "Authorization: Bearer $TAVILY_API_KEY" \
  --header 'Content-Type: application/json' \
  --data '{
Confidence
91% confidence
Finding
https://api.tavily.com/

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
curl --request POST \
  --url https://api.tavily.com/crawl \
  --header "Authorization: Bearer $TAVILY_API_KEY" \
  --header 'Content-Type: application/json' \
  --data '{
Confidence
90% confidence
Finding
https://api.tavily.com/

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
curl --request POST \
  --url https://api.tavily.com/map \
  --header "Authorization: Bearer $TAVILY_API_KEY" \
  --header 'Content-Type: application/json' \
  --data '{
Confidence
88% confidence
Finding
https://api.tavily.com/

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.