ClawHub
Back to skill

Security audit

Tavily Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Tavily web-search helper, but users should avoid putting sensitive information in search queries or printing the API key.

Install only if you are comfortable sending search queries to Tavily and storing a Tavily API key for the skill. Do not search for secrets, credentials, private customer data, or internal project details unless your policy allows sharing them with Tavily, and use a presence check instead of printing the API key if troubleshooting.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:110
Finding

API Key Disclosure Through Diagnostic Command

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 110
Vulnerability Type: Secret exposure through insecure diagnostic guidance
Risk Level: Medium

Vulnerable Code Snippet:

markdown
- Check API key is set: `echo $TAVILY_API_KEY`

Technical Analysis

The documented diagnostic command prints the complete Tavily API key to standard output. Although the command does not transmit the key to an undeclared endpoint, revealing a credential in terminal output violates secure secret-handling practices.

Terminal output may be retained in CI logs, agent execution transcripts, shell session recordings, support tickets, screen captures, or shared terminal sessions. Confirming whether an environment variable is configured does not require displaying its value.

Attack Path

  1. A user or automated agent follows the documented troubleshooting instruction.
  2. echo $TAVILY_API_KEY writes the complete bearer credential to standard output.
  3. The output is retained in a log, transcript, recording, or another observable channel.
  4. A party with access to that output obtains the API key.
  5. The exposed key is reused to authenticate requests to the Tavily API until it is rotated or revoked.

Impact Assessment

An attacker could obtain the privileges assigned to the exposed Tavily API key. The likely scope includes making Tavily API requests, consuming the account's search quota, triggering usage charges, and exhausting rate limits. The finding does not provide local system privileges, arbitrary code execution, or access beyond the permissions granted to the Tavily credential.

Remediation
View remediation

Remediation Suggestions

Replace the secret-printing command with a presence check that never reveals the credential:

bash
if [ -n "${TAVILY_API_KEY:-}" ]; then
    echo "TAVILY_API_KEY is set"
else
    echo "TAVILY_API_KEY is not set"
fi

Alternatively, use:

bash
test -n "${TAVILY_API_KEY:-}" && echo "TAVILY_API_KEY is set" || echo "TAVILY_API_KEY is not set"

Additional hardening measures:

  • Explicitly warn users not to print, log, paste, or commit API keys.
  • Redact credentials from CI logs and agent transcripts.
  • Rotate the Tavily API key if it has already appeared in recorded output.
  • Restrict the key's quota and permissions where supported.
  • Keep the key in a dedicated secret manager or protected environment variable.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (10)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill instructs use of shell commands (curl, jq) but does not declare any explicit tool scope such as permissions or allowed-tools. That omission increases the risk of overbroad execution in agent environments because the skill's operational capabilities are not constrained or transparently declared.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

Basic Search

bash
# Search for a topic
curl -X POST "https://api.tavily.com/search" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TAVILY_API_KEY" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

Basic Search

bash
# Search for a topic
curl -X POST "https://api.tavily.com/search" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TAVILY_API_KEY" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

Basic Search

bash
# Search for a topic
curl -X POST "https://api.tavily.com/search" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TAVILY_API_KEY" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

Basic Search

bash
# Search for a topic
curl -X POST "https://api.tavily.com/search" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TAVILY_API_KEY" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

Basic Search

bash
# Search for a topic
curl -X POST "https://api.tavily.com/search" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TAVILY_API_KEY" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

Basic Search

bash
# Search for a topic
curl -X POST "https://api.tavily.com/search" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TAVILY_API_KEY" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This script performs an outbound HTTPS POST to Tavily and includes user-controlled query content in the request body. While external communication is expected for a web-search skill, it still creates a real data exposure boundary: anything entered as a query leaves the local environment and is shared with a third-party service.

Content

Scanner excerpt · tavily-search.sh (reported line 69)May include surrounding context.

sh
fi

# Make API request
curl -s -X POST "https://api.tavily.com/search" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TAVILY_API_KEY" \
  -d "{

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This script performs an outbound HTTPS POST to Tavily and includes user-controlled query content in the request body. While external communication is expected for a web-search skill, it still creates a real data exposure boundary: anything entered as a query leaves the local environment and is shared with a third-party service.

Content

Scanner excerpt · tavily-search.sh (reported line 69)May include surrounding context.

sh
fi

# Make API request
curl -s -X POST "https://api.tavily.com/search" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TAVILY_API_KEY" \
  -d "{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script sends the user-provided search query to Tavily's external API but does not provide any disclosure, consent prompt, or warning at the point of transmission. In a skill context, users may supply sensitive research terms, internal project names, credentials, or personal data, and this information would be exfiltrated to a third party without an explicit user-facing notice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.