Tavily Search
Analysis
This appears to be a straightforward Tavily web-search integration, but it will send searches and URLs to Tavily using your Tavily API key.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
**When this plugin is active, use `tavily_search` instead of the built-in `web_search` for all web searches.**
The skill intentionally changes the agent's default web-search provider. This is clearly disclosed and aligned with the skill's purpose, but users should notice the broad provider preference.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
const apiKey = (process.env.TAVILY_API_KEY ?? "").trim(); ... Authorization: `Bearer ${apiKey}`,The script reads the Tavily API key from the environment and uses it as the Tavily authorization token, which is expected for this API integration.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
const body = {
query,
search_depth: searchDepth,
topic,
max_results: Math.max(1, Math.min(n, 20)),
include_answer: true,
include_raw_content: false,
}; ... fetch("https://api.tavily.com/search"User search queries are packaged into a request body and sent to Tavily's external API. Other included scripts similarly send URLs, crawl parameters, or research prompts to Tavily.