Security audit
Tavily OpenClaw plugin
Security checks for vulnerabilities and agentic risk
Overview
ClawScan rated the Tavily plugin benign with high confidence; the completed scan reported no findings, and all five security dimensions are marked ok.
The scan found no issues and the verdict is benign, but that does not guarantee the plugin is risk-free. Consider whether you trust the plugin and whether it suits your needs before installing.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
SkillSpector findings are pending for this release.
Endor dependency reachability
Checked Nov 10, 2026 · 5:46 PM UTC
No reachable vulnerabilities reported
Endor dependency scan completed.