Tavily Search 1.0.0
v1.0.0AI-optimized web search using Tavily API providing concise, relevant results and optional deep or topic-specific queries for AI agents.
⭐ 3· 4.1k·189 current·211 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the actual behavior: the scripts call Tavily API endpoints for search and extraction. Required binary (node) and primaryEnv (TAVILY_API_KEY) are appropriate. Minor metadata inconsistency: the registry Owner ID (kn70vz3ncrgs3bztcbvkb9246d814db5) differs from the _meta.json ownerId (kn7azq5e6sw0fbwwzdpcwvvjzd7z0x4z); this may be a packaging/metadata error but does not change the skill's runtime behavior.
Instruction Scope
SKILL.md instructs only running the included node scripts with CLI args. The scripts only read command-line args and TAVILY_API_KEY, then POST to api.tavily.com; they do not read other files, credentials, or system paths.
Install Mechanism
No install spec or remote downloads; code is shipped in the package and requires an existing Node runtime. This is low-risk for installation.
Credentials
Only a single service credential (TAVILY_API_KEY) is required and is used directly by the scripts. No unrelated secrets or multiple credentials are requested.
Persistence & Privilege
Skill does not request persistent/system-wide privileges; always is false and it does not modify other skills or system config. Agent autonomous invocation remains the platform default (disable-model-invocation:false) which is expected.
Assessment
This skill appears to do what it claims: it sends your TAVILY_API_KEY and query or URL data to api.tavily.com and prints results. Before installing, consider: (1) only provide your Tavily API key if you trust the Tavily service and the publisher; the scripts send the API key in request bodies to Tavily. (2) Extracting page content will transmit that page text to Tavily — avoid using it for private/internal URLs. (3) Verify the small metadata mismatch in ownerId with the publisher if provenance is important. (4) Ensure your Node runtime is recent enough to support fetch (Node 18+), and that network access to api.tavily.com is acceptable in your environment.Like a lobster shell, security has layers — review code before you run it.
latestvk97ab7qv0mvamrmy03xews4ygn815q6y
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🔍 Clawdis
Binsnode
EnvTAVILY_API_KEY
Primary envTAVILY_API_KEY