Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Openclaw Tavily Search

v0.2.0

Web search and data retrieval via Tavily API. Use when you need to search the web, get news, find answers, or look up sources. Supports 5 modes: search (gene...

0· 106·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for nowhere1975/tavily-search-enhanced.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Openclaw Tavily Search" (nowhere1975/tavily-search-enhanced) from ClawHub.
Skill page: https://clawhub.ai/nowhere1975/tavily-search-enhanced
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install tavily-search-enhanced

ClawHub CLI

Package manager switcher

npx clawhub@latest install tavily-search-enhanced
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description match the included script: the Python code calls Tavily search/news/qna/images/context endpoints and formats results as described. That alignment is coherent.
!
Instruction Scope
SKILL.md instructs running the included Python script and documents TAVILY_API_KEY, but the code also looks for a fallback key in ~/.openclaw/.env (reads the file from the user's home). The registry metadata did not declare this config-file access. Reading a home-directory file is outside what a minimal search client necessarily needs to do (it could rely solely on an env var).
Install Mechanism
No install spec; this is an instruction-only skill with an included script. Nothing is downloaded or written to disk at install time by the package itself.
!
Credentials
SKILL.md and the script expect a TAVILY_API_KEY (and optional TAVILY_SEARCH_DEPTH). However the registry metadata lists no required env vars or primary credential. The script will also permissively read ~/.openclaw/.env to extract the key, which is a broader file access than the registry declares.
Persistence & Privilege
The skill is not always-enabled and does not request elevated/system-wide persistence. It does not modify other skills or system configuration.
What to consider before installing
This skill is broadly what it claims (a Tavily API search client), but there are a few mismatches you should consider before installing: - Required credential not declared: the package registry metadata does not list any required env vars, yet both SKILL.md and the script require TAVILY_API_KEY. Expect to provide that API key to use the skill. - Hidden config-file fallback: the script will try to read ~/.openclaw/.env to find TAVILY_API_KEY if the env var is not set. If you store the key there, review the file contents and its permissions; the skill reads the file from your home directory. - Network behavior: the script sends your queries and the API key to api.tavily.com. Only proceed if you trust Tavily and are comfortable with the queries being sent to that third party. - Metadata inconsistencies: internal _meta.json values (version/owner) differ from registry metadata, which could indicate sloppy packaging. Recommendations: - If you plan to use it, set TAVILY_API_KEY explicitly as an environment variable rather than relying on the fallback file. - Inspect ~/.openclaw/.env before placing any secrets in it; prefer secure storage with limited file permissions. - Verify you trust the Tavily service (api.tavily.com) and the skill author. If unsure, avoid exposing production or multi-service credentials to this skill. Confidence notes: The code is readable and not obfuscated; the main concerns are metadata/env-var mismatches and the undocumented file read. These suggest sloppy packaging or insufficient declarations rather than clearly malicious behavior.

Like a lobster shell, security has layers — review code before you run it.

latestvk97063g81rfjnmtyenzm4z76tx83az83
106downloads
0stars
1versions
Updated 1mo ago
v0.2.0
MIT-0

Tavily Search — Enhanced Edition

Tavily is a search API optimized for AI applications — returns structured results with relevance scores and optional AI-generated summaries.

Quick Start

# Standard search (default, 5 results, ~brave format)
python3 {baseDir}/scripts/tavily_search.py --query "..." --format md

# Include AI short answer
python3 {baseDir}/scripts/tavily_search.py --query "..." --include-answer

# Advanced search (higher quality, slower)
python3 {baseDir}/scripts/tavily_search.py --query "..." --search-depth advanced

Output Formats

FormatDescriptionBest For
--format mdHuman-readable MarkdownDirect user display
--format bravetitle/url/snippet JSONStructured processing (default)
--format rawFull JSON with all fieldsDebugging / advanced use

Modes

--mode search (default)

General web search. Good for research, finding links, fact-checking.

python3 {baseDir}/scripts/tavily_search.py --query "OpenAI GPT-5 release" --mode search

--mode news

Fresh news headlines (past N days). Good for current events, breaking news.

python3 {baseDir}/scripts/tavily_search.py --query "US Iran war" --mode news --days 7

--mode qna

Direct Q&A — asks Tavily to answer a specific question from web sources.

python3 {baseDir}/scripts/tavily_search.py --query "What happened at Nvidia GTC 2026?" --mode qna

--mode images

Image search results.

python3 {baseDir}/scripts/tavily_search.py --query "Tesla Cybertruck" --mode images

--mode context

Research-oriented — includes related topics, better for deep dives.

python3 {baseDir}/scripts/tavily_search.py --query "Claude AI agent architecture" --mode context

Common Options

FlagDefaultDescription
--max-results N5Number of results (max 10)
--include-answeroffAdd AI-generated short answer
--search-depthbasicbasic (fast) or advanced (better quality)
--days N3Freshness for news mode (1-7)
--domainsnoneRestrict to domain(s), e.g. --domains reuters.com bbc.com

Environment Variables

VariableDescription
TAVILY_API_KEYAPI key (from tavily.io)
TAVILY_SEARCH_DEPTHDefault: basic or advanced

Examples

# Quick fact-check
python3 {baseDir}/scripts/tavily_search.py --query "Charlie Kirk death September 2025" --include-answer

# Latest news on a topic
python3 {baseDir}/scripts/tavily_search.py --query "AI agents March 2026" --mode news --days 7 --format md

# Deep research with related topics
python3 {baseDir}/scripts/tavily_search.py --query "Claude Opus 4.6 capabilities" --mode context --search-depth advanced

# Domain-restricted search
python3 {baseDir}/scripts/tavily_search.py --query "China EV market 2026" --domains reuters.com bloomberg.com

Notes

  • Keep --max-results small (3–5) by default to reduce token/reading load
  • Prefer --format md when displaying results directly to users
  • Use --include-answer for quick summaries without reading all results
  • Dev plan: 1000 searches/month. Pro plan: unlimited.

Comments

Loading comments...