Tavily Search 极简版

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:32 PM UTC
• Version:
  1.0.4

Overview

This is a straightforward Tavily search helper that discloses its API key requirement and external search request.

Install only if you are comfortable sending search queries, domain filters, selected search options, and your Tavily API-authenticated request to Tavily. Avoid putting secrets or sensitive internal terms in search queries, prefer setting TAVILY_API_KEY as an environment variable, and review any README-suggested OpenClaw configuration changes before applying them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 78% confidence
• Finding: The skill sends user-supplied queries and optional result content preferences to a third-party search API, but the code provides no explicit runtime notice or consent mechanism about that external transmission. In an agent context, users may assume searches are local, so sensitive prompts or internal terms could be disclosed to the external provider unintentionally.

VirusTotal

65/65 vendors flagged this skill as clean.