ClawHub
Back to skill

Security audit

Tavily Fact-Check Search

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Tavily web-search helper; its main privacy consideration is that it can read a local API key fallback file and sends search queries to Tavily.

Install only if you are comfortable with Tavily receiving your search queries and API key for searches. Prefer setting TAVILY_API_KEY explicitly in the runtime environment; if you use ~/.env, be aware the script will read that file locally to look for the Tavily key.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The script reads credentials from ~/.openclaw/.env and ~/.env, which expands its access beyond the stated web-search function into local secret discovery. Even though it only looks for TAVILY_API_KEY, reading user dotfiles is a sensitive capability and creates unnecessary exposure if the skill is invoked in environments where local files should not be touched.

Credential Access

High
Category
Privilege Escalation
Content
let apiKey = (process.env.TAVILY_API_KEY ?? '').trim();

if (!apiKey) {
  // Fallback: read from ~/.openclaw/.env or ~/.env
  for (const envPath of [
    path.join(homedir(), '.openclaw', '.env'),
    path.join(homedir(), '.env'),
Confidence
96% confidence
Finding
This finding points to the same credential-access behavior: the script inspects local .env files in the home directory when no environment variable is present. Accessing user secret files is sensitive and unnecessary for a narrowly scoped search utility, making this a real overreach even absent obvious exfiltration of unrelated secrets.

Credential Access

High
Category
Privilege Escalation
Content
let apiKey = (process.env.TAVILY_API_KEY ?? '').trim();

if (!apiKey) {
  // Fallback: read from ~/.openclaw/.env or ~/.env
  for (const envPath of [
    path.join(homedir(), '.openclaw', '.env'),
    path.join(homedir(), '.env'),
Confidence
96% confidence
Finding
This finding points to the same credential-access behavior: the script inspects local .env files in the home directory when no environment variable is present. Accessing user secret files is sensitive and unnecessary for a narrowly scoped search utility, making this a real overreach even absent obvious exfiltration of unrelated secrets.

Credential Access

High
Category
Privilege Escalation
Content
if (!apiKey) {
  // Fallback: read from ~/.openclaw/.env or ~/.env
  for (const envPath of [
    path.join(homedir(), '.openclaw', '.env'),
    path.join(homedir(), '.env'),
  ]) {
    try {
Confidence
95% confidence
Finding
Referencing ~/.openclaw/.env as a fallback secret source grants the skill local credential-reading capability that is not essential to performing a search. In agent environments, such local file access is more dangerous because users may assume the tool only contacts a search API, not reads from home-directory configuration files.

Credential Access

High
Category
Privilege Escalation
Content
// Fallback: read from ~/.openclaw/.env or ~/.env
  for (const envPath of [
    path.join(homedir(), '.openclaw', '.env'),
    path.join(homedir(), '.env'),
  ]) {
    try {
      const content = await readFile(envPath, 'utf-8');
Confidence
95% confidence
Finding
Referencing ~/.env as a fallback is particularly risky because that file often aggregates many unrelated credentials, and reading it broadens access to potentially sensitive material outside the tool's purpose. Even though the regex extracts TAVILY_API_KEY, the capability itself is excessive and could be repurposed or mishandled later.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/search.mjs:88