ClawHub
Back to skill

Security audit

Tavily Search Litiao

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Tavily web search and URL extraction helper that sends user-provided queries or URLs to Tavily using a Tavily API key.

Install this only if you are comfortable sending your search queries or supplied URLs to Tavily and using a Tavily API key from your environment. Avoid passing private, internal, or sensitive URLs unless your Tavily account and data-handling expectations allow it.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill invokes Node scripts that require both network access and an environment variable containing an API key, but the manifest does not declare any explicit tool scope such as permissions or allowed-tools. This creates a least-privilege and transparency gap: a host may grant broader capabilities than users expect, and reviewers cannot easily determine or constrain what the skill is allowed to access.

External Transmission

Medium
Category
Data Exfiltration
Content
process.exit(1);
}

const resp = await fetch("https://api.tavily.com/extract", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
process.exit(1);
}

const resp = await fetch("https://api.tavily.com/extract", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
process.exit(1);
}

const resp = await fetch("https://api.tavily.com/extract", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
The manifest says the skill provides AI-optimized web search and concise relevant results, but this file calls Tavily's /extract endpoint on user-supplied URLs and prints raw extracted page content. That is a materially different capability from performing search queries and returning search results.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
This code posts the provided URLs and the TAVILY_API_KEY to an external service, which is a safety-relevant network operation involving user/system data. While the script errors if the API key is missing, it does not print any notice, confirmation, or explanatory comment warning that inputs will be sent to a third-party API.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The manifest promises concise, relevant search results for AI agents, but the script prints each page's raw_content directly, which may be lengthy full-text extraction rather than concise search output. This is a semantic mismatch in the delivered behavior, not just an implementation detail.

External Transmission

Medium
Category
Data Exfiltration
Content
body.days = days;
}

const resp = await fetch("https://api.tavily.com/search", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.