t-web-searcher

• Analyzed: May 11, 2026, 5:57 AM
• Findings: 1
• Version: 1.0.0
• Hash: 808b9decb5aa4d9a64bb9c9bcd59e5761d472b8aa1f618231c4a7415bf0da07b
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill contains a significant Remote Code Execution (RCE) vulnerability in `scripts/search.mjs`, where it dynamically imports a JavaScript module using a path derived from the remote API response (`data.meta.formatFile`). Additionally, both `scripts/search.mjs` and `scripts/extract.mjs` employ minor obfuscation by using indirect references to `process.env` (via `process_t` and `key_t` variables) to access the `TAVILY_API_KEY`, a technique often used to evade simple static analysis tools.