ClawHub
Back to skill

Security audit

Tavily Search

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Tavily search integration with expected third-party API use, though users should treat queries, URLs, and crawl targets as data sent outside their environment.

Install in a virtual environment, pin or lock dependencies if you need reproducibility, and avoid sending secrets, private URLs, internal hostnames, or confidential research prompts to Tavily. Be especially careful with crawl because external traversal is enabled by default and can consume API credits.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Unpinned Third-Party Dependencies Permit Unreviewed Package Installation

Content
View full analysis

Vulnerability Details

File Location: requirements.txt:1-2; installation instruction at SKILL.md:13
Vulnerability Type: Supply-chain risk caused by non-reproducible dependency resolution
Risk Level: Medium

Complete Vulnerable Code Snippet:

text
requests>=2.31.0
urllib3>=2.0.0

The dependencies are installed using the following documented command:

bash
pip install -r requirements.txt

Technical Analysis

Both dependencies use lower-bound-only version constraints. Consequently, installation may resolve to any future version satisfying those constraints rather than to versions that were reviewed during this audit. No lock file, exact version constraint, package hash, or hash-verification requirement is present.

Python packages can execute code during installation and whenever imported. If an eligible dependency release or the configured package index is compromised, the installation process can retrieve and execute code that was not part of the audited Skill. The resulting environment is also non-reproducible because different installation dates may produce different dependency versions.

This finding concerns unsafe version resolution and integrity verification. The reviewed dependency names are legitimate and no evidence establishes that their current releases are malicious.

Attack Path

  1. An attacker compromises the release process, maintainer account, or distribution channel of an eligible dependency.
  2. The attacker publishes a malicious version satisfying requests>=2.31.0 or urllib3>=2.0.0.
  3. A user follows the installation command in SKILL.md.
  4. pip resolves the malicious release because no exact version or cryptographic hash is required.
  5. Attacker-controlled code executes during package installation or when scripts/search.py imports the dependency.

Impact Assessment

Malicious dependency code would execute with the privileges of t ...[truncated 649 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace lower-bound constraints with exact, reviewed versions, for example:

    text
    requests==REVIEWED_VERSION
urllib3==REVIEWED_VERSION

  2. Generate and commit a reproducible lock file containing the complete transitive dependency graph.

  3. Record SHA-256 hashes for every permitted distribution and require verification during installation:

    bash
    python -m pip install --require-hashes -r requirements.txt

  4. Generate pinned artifacts through a trusted dependency-management process, such as pip-compile --generate-hashes.

  5. Install from an explicitly configured trusted package index and avoid untrusted supplemental indexes.

  6. Use automated vulnerability and release monitoring, but update pinned versions only after review and testing.

  7. Perform installation and execution as a non-administrative user in an isolated virtual environment or container to reduce the impact of a compromised package.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (27)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared description presents the skill as a search integration, but the documentation also exposes broader capabilities: whole-site crawling, long-running research task creation/polling, usage/account queries, and local .env credential loading. This mismatch can mislead users and reviewers about the actual data access and network behavior, increasing the chance of unintended external access or oversharing.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/search.py (reported line 13)May include surrounding context.

python
from typing import Optional, List, Dict, Any

# 只读取TAVILY_API_KEY环境变量
with open(os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))), ".env"), "r") as f:
    for line in f:
        line = line.strip()
        if line and not line.startswith("#") and "=" in line:

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/search.py (reported line 26)May include surrounding context.

python
def __init__(self, api_key: Optional[str] = None):
        self.api_key = api_key or os.getenv("TAVILY_API_KEY")
        if not self.api_key:
            raise ValueError("TAVILY_API_KEY 未配置，请在 .env 文件中设置")
        self.base_url = "https://api.tavily.com"
    
    def search(

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill declares access to an API key and clearly performs outbound network requests, but it does not declare an explicit tool scope such as allowed-tools or permissions. This weakens reviewability and runtime policy enforcement because consumers cannot easily tell that the skill reads credentials and transmits data externally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documentation describes sending searches, URLs, extraction targets, and crawl instructions to Tavily but does not warn that this data leaves the local environment and is processed by a third-party service. Users may submit sensitive queries, internal URLs, or regulated data without informed consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The referenced Tavily API endpoint confirms outbound communication to a third-party service. This is not inherently unsafe for a search integration, but in the absence of explicit scope and privacy warnings it increases the risk of unnoticed data egress.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md
python scripts/search.py search "搜索关键词" [选项]

# 最简调用
curl -X POST https://api.tavily.com/search \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TAVILY_API_KEY" \
  -d '{"query": "搜索关键词", "include_answer": true}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The referenced Tavily API endpoint confirms outbound communication to a third-party service. This is not inherently unsafe for a search integration, but in the absence of explicit scope and privacy warnings it increases the risk of unnoticed data egress.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md
python scripts/search.py search "搜索关键词" [选项]

# 最简调用
curl -X POST https://api.tavily.com/search \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TAVILY_API_KEY" \
  -d '{"query": "搜索关键词", "include_answer": true}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The crawl feature is documented as capable of traversing many pages and, by default, allowing external domains, but there is no warning about broad external access, load generation, or collection of unintended content. In agent contexts, this can lead to excessive third-party requests, reputational issues, or accidental gathering/transmission of sensitive data.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The documented Tavily endpoint in the news-search example indicates third-party data egress. Context makes this expected, but still potentially risky when users assume a local-only skill or are unaware of external processing.

Content

Scanner excerpt · SKILL.md (reported line 251)May include surrounding context.

使用示例

搜索最新新闻

bash
curl -X POST https://api.tavily.com/search \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TAVILY_API_KEY" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The documented Tavily endpoint in the news-search example indicates third-party data egress. Context makes this expected, but still potentially risky when users assume a local-only skill or are unaware of external processing.

Content

Scanner excerpt · SKILL.md (reported line 251)May include surrounding context.

使用示例

搜索最新新闻

bash
curl -X POST https://api.tavily.com/search \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TAVILY_API_KEY" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The professional-search example transmits potentially detailed technical queries and may request raw content from external sources via Tavily. That can increase privacy and compliance risk because more source material and user intent are shared with a third party.

Content

Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.

专业资料搜索

bash
curl -X POST https://api.tavily.com/search \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TAVILY_API_KEY" \
  -d '{

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

标题和整份 API 文档内容均以中文呈现，且没有说明这是仅面向中文用户的区域性文档，也未提供其他语言选项。根据语言/locale 政策，若技能或文档默认强制单一语言而没有用户选择或明确合理性，属于自然语言策略违规。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

Access to sensitive credentials is a safety-relevant operation under this rule, and this file silently loads TAVILY_API_KEY from a parent-directory .env file. Aside from an inline Chinese comment, there is no user-facing warning, prompt, or CLI documentation indicating that credentials will be read automatically from disk and used for external API authentication.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The search method sends user-controlled query data to an external service. While this is expected for a search integration, it is still a real external transmission point that can leak sensitive prompts or internal search terms if callers are unaware or unconstrained.

Content

Scanner excerpt · scripts/search.py (reported line 86)May include surrounding context.

python
"Authorization": f"Bearer {self.api_key}"
        }
        
        response = requests.post(f"{self.base_url}/search", json=payload, headers=headers)
        response.raise_for_status()
        return response.json()

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

User-supplied queries, URLs, and crawl instructions are transmitted to a third-party API without any user-facing notice or consent mechanism. In a skill meant for search and extraction, this creates privacy and data handling risk, especially if users submit proprietary links, internal URLs, or sensitive research prompts.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The extract endpoint transmits arbitrary user-provided URLs and optional query context to Tavily. This can expose internal resource locations, confidential documents, or sensitive browsing targets to a third party if the skill is used in enterprise or agent workflows.

Content

Scanner excerpt · scripts/search.py (reported line 117)May include surrounding context.

python
"Authorization": f"Bearer {self.api_key}"
        }
        
        response = requests.post(f"{self.base_url}/extract", json=payload, headers=headers)
        response.raise_for_status()
        return response.json()

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest describes a Tavily search integration for web search, content extraction, and real-time news queries. This file also exposes separate deep research job orchestration and site-wide crawling capabilities, which are materially broader than simple search/extraction and are not mentioned in the manifest description.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The research endpoint sends potentially rich freeform input and optional schema definitions to a third-party service. Research prompts often contain strategic, legal, or proprietary information, so undisclosed transmission meaningfully increases confidentiality risk.

Content

Scanner excerpt · scripts/search.py (reported line 144)May include surrounding context.

python
"Authorization": f"Bearer {self.api_key}"
        }
        
        response = requests.post(f"{self.base_url}/research", json=payload, headers=headers)
        response.raise_for_status()
        return response.json()

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The whole-site crawl capability materially increases data exposure compared with a simple search tool because it can send arbitrary root URLs and crawl instructions to an external service and collect large amounts of site content. In an agent context, this broadens the blast radius of prompt injection, overcollection, and unintended access to internal or sensitive web resources if callers are not constrained.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

The crawl endpoint transmits a root URL plus crawl instructions to an external service and can cause broad collection of site content, especially with external traversal enabled. In agent settings this is more dangerous than ordinary search because it can overcollect data from many pages and potentially include sensitive internal targets or attacker-influenced instructions.

Content

Scanner excerpt · scripts/search.py (reported line 204)May include surrounding context.

python
"Authorization": f"Bearer {self.api_key}"
        }
        
        response = requests.post(f"{self.base_url}/crawl", json=payload, headers=headers)
        response.raise_for_status()
        return response.json()

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

Most of the natural-language documentation is presented only in Chinese, and no language choice or locale justification is provided. Under the stated policy, forcing a specific language without user opt-in can be a language/locale policy violation.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The dependency is specified with a lower-bound version only, which makes builds non-reproducible and allows future installs to pull different releases with different security properties. In a network-facing search integration that relies on HTTP clients, this increases supply-chain and patch-regression risk because the exact package version is unknown at install time.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
requests>=2.31.0
urllib3>=2.0.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
83% confidence
Finding

Requests has multiple known advisories, and because the manifest does not pin a specific version, it is impossible to confirm whether deployed environments will install a fixed or vulnerable release. In a skill that performs outbound web requests, exposure in the HTTP client can directly affect confidentiality and request-handling security, including issues like credential leakage or certificate verification problems depending on the resolved version.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

Using an unpinned urllib3 version means installations may resolve to different releases over time, preventing reproducible builds and making it hard to verify exposure to known CVEs. Because this skill performs web access, a core HTTP library changing unexpectedly can affect TLS, redirect, proxy, and decompression behavior in security-relevant ways.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
requests>=2.31.0
urllib3>=2.0.0

Unverifiable Dependency: urllib3 has 16 known advisory(ies) (CVE-2025-66471 (urllib3 streaming API improperly handles highly compressed data); CVE-2024-37891 (urllib3's Proxy-Authorization request header isn't stripped during cross-origin ); CVE-2026-21441 (Decompression-bomb safeguards bypassed when following HTTP redirects (streaming ) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
83% confidence
Finding

Urllib3 has known advisories, but the unpinned requirement prevents verification that the installed version contains the necessary fixes. Given this skill's search and content-retrieval context, urllib3 is likely directly involved in processing remote responses, so unresolved vulnerabilities in redirect, proxy, or decompression handling could materially affect runtime security.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.