Cliby Tavily Search

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:00 AM UTC
• Version: 1.0.1

Overview

This Tavily search skill mostly does what it says, but its command template can let a crafted search query become shell command execution if an agent follows it literally.

Review before installing. Use the environment variable or protected .secrets/tavily.key file instead of --api-key, and only invoke this skill through an argument-array/subprocess path where the query is passed as one argument, not by interpolating the query into a shell command. Expect search queries to be sent to Tavily.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:23

Finding

Unsafe shell interpolation of user-controlled search queries

Content

View full analysis

" ``` ``` ### Technical Analysis The Skill instructs the Agent to substitute an untrusted user query directly into a quoted shell command. It does not require execution through an argument array, prohibit shell invocation, or specify shell-safe escaping. If the Agent constructs the documented command literally, a query containing a double quote followed by shell metacharacters can terminate the intended argument and introduce additional commands. Quoting the placeholder with literal double quotes is insufficient because the substituted value itself may contain a double quote. The Python script does not itself invoke a shell. The vulnerability exists in the Skill's invocation instructions and is exploitable when the Agent or runtime implements those instructions by constructing and executing a shell command. ### Attack Path 1. An attacker asks the Agent to search for a specially crafted query, such as: ```text "; id > /tmp/query-injection-proof; # ``` 2. The Agent substitutes the query into the documented template: ```bash python3 /path/to/scripts/tavily_search.py --query ""; id > /tmp/query-injection-proof; #" ``` 3. A shell parses the injected semicolons as command separators. 4. The Tavily script is invoked with an empty query, after which the injected command runs under the Agent process's operating-system identity. 5. The attacker may adapt the injected command to read accessible files, modify workspace data, invoke installed tools, or transmit locally accessible information. ### Impact Assessment Successful exploitation permits arbitrary command execution with the privileges of the user or service running the Agent. The accessible scope may incl ...[truncated 410 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/tavily_search.py:12

Finding

Tavily API key exposure through command-line arguments

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 56)May include surrounding context.

bash

mkdir -p skills/cliby-tavily-search/.secrets
chmod 700 skills/cliby-tavily-search/.secrets

Create the key file:

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 80)May include surrounding context.

Set permissions:

bash

chmod 600 skills/cliby-tavily-search/.secrets/tavily.key

Usage

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill invokes code with access to environment variables, local file reads, and network access, but the manifest does not declare any explicit tool scope or permissions. That makes the skill's effective capabilities less transparent to the agent/runtime and reviewers, increasing the risk of over-privileged execution, accidental secret exposure, or unintended data egress if the backing script behavior changes or is abused.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger description is very broad ('search the web', 'research a topic', 'look up recent information') and can match a large fraction of ordinary user requests. This raises the chance of unintended invocation, which is especially relevant because the skill performs network access and may use configured credentials, leading to unnecessary external queries, privacy leakage of user prompts, or bypass of more appropriate skills.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/tavily_search.py (reported line 11)May include surrounding context.

python

import urllib.request


API_URL = "https://api.tavily.com/search"


def load_api_key(args: argparse.Namespace):

Static analysis

No suspicious patterns detected.