Business Writing Litiao

PassAudited by ClawScan on May 1, 2026.

Overview

No harmful behavior is shown; this is a business-writing prompt that uses Tavily search, but users should verify the Tavily API key use, external helper script, and metadata mismatch.

This skill appears safe for its stated purpose, but install it only if you are comfortable providing a Tavily API key and relying on the separate Tavily search helper it calls. Also check the publisher/version metadata if you require strong provenance.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

The skill may use the user's Tavily account for web research queries.

Why it was flagged

The skill requires a Tavily API key. This is expected for Tavily-powered research, but it is still a service credential that may consume the user's quota or account access.

Skill content

requires":{"env":["TAVILY_API_KEY"]}

Recommendation

Use a Tavily key intended for this purpose, monitor usage, and revoke or rotate it if no longer needed.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

If the referenced Tavily helper is absent, outdated, or untrusted, research behavior may fail or depend on code outside this reviewed package.

Why it was flagged

The skill depends on a separate local Tavily search script that is not part of this package. This is disclosed and purpose-aligned, but users should trust that helper skill before relying on it.

Skill content

cd ~/.openclaw/workspace/skills/tavily-search-litiao
node scripts/search.mjs "[industry] analysis report trends" --deep -n 15

Recommendation

Install and verify the referenced Tavily search helper from a trusted source before using this skill.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

The mismatch may make it harder to confirm exactly which package, owner, or version the skill came from.

Why it was flagged

The bundled _meta.json identifies a different slug, owner, and version than the supplied registry metadata for business-writing-litiao v1.0.1, creating a packaging/provenance inconsistency.

Skill content

"ownerId": "kn7bmx37krjakh5gesbg2498cs816br8", "slug": "business-writing", "version": "0.1.0"

Recommendation

Verify the publisher and package identity before installing if provenance matters for your environment.