Tavily Web Search Skill for OpenClaw 🦀

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 7:20 PM UTC
• Version: 1.0.0

Overview

This is a straightforward Tavily web-search skill that sends search queries to Tavily and reads a local API key, with no evidence of hidden persistence, privilege escalation, or unrelated behavior.

Install only if you are comfortable sending search queries and related search options to Tavily using your Tavily API key. The chmod setup steps are protective file permissions, not elevated access, but keep the API key out of source control and avoid using this for sensitive internal research terms unless Tavily use is approved.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
mkdir -p skills/tavily/.secrets
chmod 700 skills/tavily/.secrets
```

Create the key file:

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

Set permissions:

```bash
chmod 600 skills/tavily/.secrets/tavily.key
```

## Usage

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill invokes a Python script that performs network access and may read a local secret file, but the manifest declares no explicit tool scope such as permissions or allowed-tools. This creates an authorization and review gap: consumers cannot easily tell that using the skill may access the network and local files, increasing the chance of unintended data exposure or overbroad execution.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger description is very broad and could cause this skill to activate for many generic research or help requests. Over-broad activation increases the likelihood of unnecessary web requests, transmission of user queries to a third-party service, and use of an API-backed tool when a safer or more appropriate local response would suffice.

External Transmission

Medium

• Category: Data Exfiltration

Content

import urllib.request


API_URL = "https://api.tavily.com/search"


def load_api_key():

• Confidence: 84% confidence
• Finding: This code is designed to communicate with an external service, so outbound transmission is intentional; however, the external API endpoint represents a genuine exfiltration path for user queries and returned metadata. In the context of an agent skill, this becomes more sensitive because users may assume local processing and may unknowingly submit confidential research terms or internal information to a third party.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script sends the user-provided query and optional content-related parameters to Tavily's external API, which creates a real data disclosure boundary. In a web-search skill this transmission is expected functionality, but it is still a valid privacy/security issue because there is no explicit consent prompt, redaction step, or warning preventing users from sending sensitive data to a third party.

Static analysis

No suspicious patterns detected.