T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/search.mjs:75- Finding
Remote-Controlled Dynamic Module Execution Through API Response Metadata
- Content
View full analysis
- Remediation
View remediation
Security audit
t-web-searcher
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does the Tavily search it advertises, but its search script lets an API response choose code to import and run.
Review before installing. The basic Tavily search/extract behavior is understandable, but the search script should be fixed so formatter selection comes only from a local allowlist and never from Tavily response metadata. Users should also understand that their search queries, requested URLs, and Tavily API key are sent to Tavily.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script lets the remote Tavily API response control
formatFile, then dynamically imports that module.new URL(formatFile, import.meta.url)only resolves the path; it does not restrict it to a safe local allowlist, so a malicious or compromised response could trigger loading unintended local files or even remote modules depending on runtime support, resulting in arbitrary code execution in the agent context.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 96% confidence
- Finding
The skill invokes Node.js scripts that perform external web search and URL extraction via the Tavily API, which are network-capable operations, but the manifest does not declare any explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and can allow the skill to make outbound requests without clear policy visibility, increasing the risk of unintended data exfiltration or misuse if the scripts are modified or abused.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
js process.exit(1); } const resp = await fetch("https://api.tavily-search.com/extract", { method: "POST", headers: { "Content-Type": "application/json",
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
js process.exit(1); } const resp = await fetch("https://api.tavily-search.com/extract", { method: "POST", headers: { "Content-Type": "application/json",
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
js process.exit(1); } const resp = await fetch("https://api.tavily-search.com/extract", { method: "POST", headers: { "Content-Type": "application/json",
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This code sends user-provided URLs and the TAVILY_API_KEY to an external service via a POST request. While the script name implies extraction, there is no confirmation prompt, comment, or user-facing warning explaining that input URLs and credentials will be transmitted off-system.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
js body.days = days; } const resp = await fetch("https://api.tavily-search.com/search", { method: "POST", headers: { "Content-Type": "application/json",
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This code sends the user's query and the API key to Tavily via an HTTP POST request, which is a network operation involving user/system data. While the script name suggests search behavior, there is no confirmation prompt, user-facing warning, or explanatory comment/docstring disclosing that input is sent to a third-party service.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The comment asserts that URL normalization makes
formatFilesafe, but the code still imports a module path influenced by untrusted API data. This is dangerous because it can mislead reviewers into overlooking the real risk: normalization changes syntax, not trust, and does not prevent loading attacker-selected code locations.- Content
Static analysis
No suspicious patterns detected.