Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward Tavily web-search helper that uses a Tavily API key and sends search queries to Tavily, with the credential behavior disclosed.
Install this only if you intend to use Tavily search. Prefer providing TAVILY_API_KEY through the environment or a secret manager; if you use ~/.openclaw/.env, understand the skill can read that file to extract the Tavily key. Search queries and the Tavily API key are sent to Tavily as part of normal operation.
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
method="POST",
)
with urllib.request.urlopen(req, timeout=30) as resp:
body = resp.read().decode("utf-8", errors="replace")
try:
Accessing ~/.openclaw/.env is credential access behavior and broadens the skill's access to local secrets beyond what is strictly necessary for a simple search wrapper. In an agent ecosystem, local secret-file reads are sensitive because they create an opportunity for accidental overreach and weaken least-privilege boundaries even if the current code only extracts TAVILY_API_KEY.
if key:
return key.strip()
env_path = pathlib.Path.home() / ".openclaw" / ".env"
if env_path.exists():
try:
txt = env_path.read_text(encoding="utf-8", errors="ignore")
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
key = load_key()
if not key:
raise SystemExit(
"Missing TAVILY_API_KEY. Set env var TAVILY_API_KEY or add it to ~/.openclaw/.env"
)
payload = {
The skill invokes a Python script that uses environment secrets, reads a local .env file path, and performs outbound network access, but the manifest declares no explicit tool scope or permissions. This creates an authorization gap where an agent or reviewer cannot easily determine what capabilities the skill requires, increasing the risk of unintended secret access and external data exfiltration.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import sys
import urllib.request
TAVILY_URL = "https://api.tavily.com/search"
def load_key():
The skill expands its privilege surface by reading credentials from ~/.openclaw/.env, which is broader than a narrowly scoped web-search helper needs if the runtime can inject secrets via environment variables. Reading a general local credential file creates unnecessary file-access capability and may expose unrelated secrets if the file format or parsing changes, especially in agent environments where least privilege matters.
No suspicious patterns detected.