Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Tavily Web Seeker
v1.1.0Enhanced Tavily search with intelligent intent recognition, source preferences, critical source validation, and offline report generation.
⭐ 0· 40·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description (Tavily web search with intent recognition and reporting) match the code and SKILL.md behavior: the script calls a Tavily search endpoint, applies domain routing and generates optional markdown reports. This capability set is coherent with the stated purpose.
Instruction Scope
SKILL.md and the script instruct running node seeker.js and optionally exporting reports. The runtime reads environment variables (TAVILY_API_KEY, TAVILY_API_KEY_2.._10, TAVILY_BASE_URL) and writes report files to ${HOME}/.openclaw/workspace/reports. Those file reads/writes and env accesses are within the described functionality, but SKILL.md/code depend on env vars that are not declared in the registry metadata (see environment_proportionality).
Install Mechanism
No install spec (instruction-only skill with a small JS script). Nothing is downloaded or extracted during install; risk from install mechanism is low.
Credentials
Registry metadata lists no required environment variables or primary credential, but SKILL.md and scripts clearly expect API keys (TAVILY_API_KEY, TAVILY_API_KEY_2.._10) and optionally TAVILY_BASE_URL. The skill also requires plugins.entries.tavily.config (declared) which may be intended to hold keys, but the explicit mismatch between declared envs (none) and actual env usage is an incoherence. Additional concerns: the code accepts TAVILY_BASE_URL override (defaulting to https://api.tavily.com) — a misconfigured or malicious base URL could redirect requests to an attacker-controlled endpoint, so verify that value before use.
Persistence & Privilege
always is false and the skill does not modify other skills or global agent config. It writes report files to the user's home workspace when export is enabled, which is reasonable for its function.
What to consider before installing
This skill appears to do what it says (query a Tavily API, respect domain preferences, and optionally save a markdown report), but the registry metadata did not declare the API keys the code actually reads. Before installing: 1) Confirm where your Tavily API keys should be stored (plugins.entries.tavily.config or environment variables) and update the skill metadata so required credentials are explicit. 2) Verify TAVILY_BASE_URL is either unset or set to the official api.tavily.com — do not point it to unknown hosts. 3) Note the script accepts up to 10 API keys and will rotate on 429s; provide only keys you trust and scope them if possible. 4) Be aware the skill will write reports to ~/.openclaw/workspace/reports when export is used; confirm that path is acceptable. 5) If you need higher assurance, request the author to (a) declare required env vars in registry, (b) document where plugin config should store secrets, and (c) provide a signed release or checksum for the script. These steps will resolve the primary incoherence and reduce risk.scripts/seeker.js:5
Environment variable access combined with network send.
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.Like a lobster shell, security has layers — review code before you run it.
latestvk975dk1ssv5yd4ea37erdtv895841hfx
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎯 Clawdis
Configplugins.entries.tavily.config