Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Tavily Fact-Check Search

v1.0.0

Enhanced Tavily web search for fact-checking and cross-verification. Aligned with official Tavily API (2026-03). Supports time_range, exact_match, domain fil...

0· 110·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for kkkkane84727/tavily-factcheck.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Tavily Fact-Check Search" (kkkkane84727/tavily-factcheck) from ClawHub.
Skill page: https://clawhub.ai/kkkkane84727/tavily-factcheck
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install tavily-factcheck

ClawHub CLI

Package manager switcher

npx clawhub@latest install tavily-factcheck
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The code and SKILL.md implement an enhanced Tavily search and only call https://api.tavily.com/search, which is coherent with the stated purpose. However, the registry metadata lists no required environment variables or primary credential while both SKILL.md and the script clearly require TAVILY_API_KEY — this inconsistency should be resolved.
!
Instruction Scope
Runtime instructions run scripts/search.mjs which reads the TAVILY_API_KEY from process.env or falls back to reading ~/.openclaw/.env and ~/.env. Reading files in the user's home directory is broader than a simple env-var lookup and could surface unexpected secrets if those files contain other data; while this behavior is used only to find the API key, the instructions do not declare or justify reading those files in the registry metadata.
Install Mechanism
There is no install spec (instruction-only skill with an included script). No remote downloads or archive extraction are present, so the install mechanism itself is low-risk.
!
Credentials
The script requires a TAVILY_API_KEY (used as api_key in requests) but the skill metadata claims no required env vars or primary credential — this is a proportionality mismatch. The script only needs a single API key for the declared API, which is reasonable, but it should be declared in the registry and the fallback file reads should be documented and justified.
Persistence & Privilege
The skill does not request always-on presence, does not modify other skills or system-wide settings, and only executes when invoked. No persistence or elevated privileges are requested.
What to consider before installing
Before installing or enabling: 1) Verify the TAVILY_API_KEY requirement — the registry metadata should list this credential but currently does not. 2) Inspect ~/.openclaw/.env and ~/.env (or set TAVILY_API_KEY in your environment) so the script won't unexpectedly read home files you consider sensitive. 3) Confirm the owner/source is trustworthy (no homepage provided). 4) If you proceed, run the script in an isolated environment (container or VM) or set the API key as an explicit env var rather than relying on file fallback. 5) Consider asking the publisher to update metadata to declare TAVILY_API_KEY and to document the fallback file reads.
scripts/search.mjs:88
Environment variable access combined with network send.
!
scripts/search.mjs:14
File read combined with network send (possible exfiltration).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

latestvk97d5j1s216th8ajms9h4cndgs83kb62
110downloads
0stars
1versions
Updated 1mo ago
v1.0.0
MIT-0

Tavily Search (Enhanced)

AI-optimized web search via Tavily API. Enhanced version with full official API parameter support.

主要用途: 交叉验证 Scout 调研结果的事实准确性,而非替代 Scout 做调研。

Usage

node {baseDir}/scripts/search.mjs "query" [options]

Options

OptionDescriptionDefault
-n <count>Max results (1-20)5
--deepAdvanced search (更准确,2 credits)basic
--topic <t>general | news | financegeneral
--time-range <r>day | week | month | year无限制
--start-date <d>YYYY-MM-DD (结果起始日期)
--end-date <d>YYYY-MM-DD (结果截止日期)
--include-domains <d>逗号分隔,限定搜索域名
--exclude-domains <d>逗号分隔,排除域名
--exact精确匹配引号内短语false
--country <name>提升特定国家结果 (china/united states/japan)
--images包含图片结果false
--raw包含页面原始 markdown 内容false
--json输出原始 JSON(供脚本消费)false

Fact-Check Examples

验证某个具体事实:

node {baseDir}/scripts/search.mjs "武侯祠 建于哪一年" --exact --include-domains baike.baidu.com,zh.wikipedia.org -n 3

验证最新新闻:

node {baseDir}/scripts/search.mjs "成都大庙会 2026" --topic news --time-range month -n 5

验证金融数据:

node {baseDir}/scripts/search.mjs "MiniMax 融资 估值" --topic finance --time-range year

深度调研 + 限定来源:

node {baseDir}/scripts/search.mjs "川剧变脸 历史 起源" --deep --country cn -n 10

When To Use

  • Scout 返回的调研结果 → 用 Tavily 交叉验证关键事实
  • 推文/内容生产 → 验证引用的数据、日期、名称是否准确
  • 时效性信息--topic news --time-range week 获取最新
  • 不要用于替代 Scout 做全面调研 — Scout 有更完整的搜索+分析能力

vs Upstream tavily-search

FeatureUpstreamThis version
time_range / start_date / end_date❌ (deprecated days)
include_domains / exclude_domains
exact_match
finance topic
country boost
include_images
raw content (markdown)
JSON output mode
const/require bugs⚠️ 2 bugs✅ Fixed
Response timing

Environment

  • TAVILY_API_KEY env var, or in ~/.openclaw/.env / ~/.env
  • Cost: 1 credit (basic) / 2 credits (advanced/deep)

Comments

Loading comments...