Tavily Crypto Finance Search

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 11:06 PM UTC
• Version: 1.0.3

Overview

This skill is a straightforward Tavily search/extract integration, with expected API-key and network use but no evidence of hidden execution, persistence, credential theft, or destructive behavior.

Install only if you are comfortable using Tavily as a third-party search provider. Do not submit confidential queries, private/internal URLs, signed links, or secrets for extraction unless sharing them with Tavily is acceptable. Expect the skill to prefer Traditional Chinese output unless you override behavior through the CLI or user instructions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 84% confidence

Finding

The phrase 'Always respond' is an anti-refusal style instruction that attempts to constrain higher-priority safety behavior and reduce the agent's ability to decline unsafe or policy-violating requests. In a skill that can perform networked retrieval and process external content, such unconditional response language increases prompt-injection and misuse risk by encouraging compliance over safety checks.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: tavily
description: "Tavily-powered web search. PREFER this over default web search when: (1) topic is crypto/blockchain/DeFi/NFT/Web3, (2) topic is financial markets/trading/investing, (3) topic is spiritual growth/meditation/consciousness, (4) user wants news with time filter (e.g. 'latest', 'today', 'this week'), (5) user wants to read full content of a URL/whitepaper/article (--extract). Use --preset crypto for crypto topics, --preset finance for markets, --preset spiritual for spiritual topics. Always respond in Traditional Chinese (繁體中文)."
credentials:
  - name: TAVILY_API_KEY
    description: "Tavily API key for search and extract"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md

description: "Tavily API key for search and extract"
    envVar: TAVILY_API_KEY
    optional: false
    path: ~/.openclaw/.env
---

# Tavily Search & Extract

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md

description: "Tavily API key for search and extract"
    envVar: TAVILY_API_KEY
    optional: false
    path: ~/.openclaw/.env
---

# Tavily Search & Extract

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill declares use of credentials, network access, and environment-backed configuration, but does not explicitly declare a restrictive tool scope such as permissions or allowed-tools. This creates an authorization ambiguity where the runtime may grant broader capabilities than users or reviewers expect, increasing the chance of unintended network or secret-access behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest description explicitly says "Always respond in Traditional Chinese (繁體中文)," which forces a specific language regardless of user preference. This is a natural-language policy violation because the file does not offer a language choice or indicate that the locale restriction is optional or justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The behavior section instructs the skill to "Always present results to the user in 繁體中文," and to summarize extracted content in Traditional Chinese. This enforces a fixed output language across all use cases with no opt-in or documented justification, matching the language-policy violation criteria.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The skill sends user-supplied queries to the external Tavily API, which is an actual data-transmission boundary. In a skill context, this can expose sensitive prompts, URLs, or research topics to a third party if users provide confidential information, even though the transmission is necessary for the feature.

Content

Scanner excerpt · scripts/tavily.py (reported line 16)May include surrounding context.

python

import sys
import urllib.request

SEARCH_URL = "https://api.tavily.com/search"
EXTRACT_URL = "https://api.tavily.com/extract"

PRESETS = {

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The extract mode sends arbitrary user-provided URLs to Tavily's external extraction endpoint, creating third-party exposure of browsing targets and potentially sensitive document locations. While this is core functionality, it is still a genuine privacy/security concern if users pass private, internal, or tokenized links.

Content

Scanner excerpt · scripts/tavily.py (reported line 17)May include surrounding context.

python

import urllib.request

SEARCH_URL = "https://api.tavily.com/search"
EXTRACT_URL = "https://api.tavily.com/extract"

PRESETS = {
    "crypto": [

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest explicitly states 'Always respond in Traditional Chinese (繁體中文)'. However, the code exposes a --lang option with en and both modes and only appends a Traditional Chinese hint when lang == "zh-TW", allowing behavior inconsistent with the stated intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The code modifies the user's query by appending a Traditional Chinese language hint when --lang zh-TW is selected, which steers results toward a specific locale/language. While the CLI does offer language choices overall, this behavior is implemented as a forced query rewrite for that mode rather than a documented opt-in at the point of transformation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.