v1.0.0

Better Tavily Search

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 8:08 AM.

Analysis

This appears to be a coherent Tavily web-search helper that uses a Tavily API key and external requests as expected, with only normal credential and data-sharing considerations.

GuidanceThis skill looks appropriate for Tavily-backed web search. Before installing, make sure you trust the registry publisher, protect your Tavily API key, verify any `TAVILY_API_BASE` setting, and avoid sending private or secret information in search queries.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agentic Supply Chain Vulnerabilities

SeverityInfoConfidenceMediumStatusNote

metadata

Source: unknown

The registry entry does not provide a known source repository, although the artifacts include the local Python helper and no install-time dependency script.

User impactUsers have less upstream provenance information for validating authorship or updates.

RecommendationReview the included script before installation and prefer updates from a trusted registry or verified publisher.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityLowConfidenceHighStatusNote

SKILL.md

Authentication is loaded by the script itself. Either of these is valid: - environment variable: `TAVILY_API_KEY` - `~/.openclaw/.env` containing `TAVILY_API_KEY=...`

The skill clearly requires and loads a Tavily API credential, including from a local OpenClaw environment file.

User impactThe skill can use your Tavily account/API quota when searches, extraction, or site maps are run.

RecommendationUse a Tavily key with appropriate quota limits, keep `~/.openclaw/.env` private, and rotate the key if it may have been exposed.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityLowConfidenceHighStatusNote

scripts/tavily.py

API_BASE = os.environ.get("TAVILY_API_BASE", "https://api.tavily.com").rstrip("/")

The helper sends requests to Tavily by default, with an environment-variable override for the API base URL.

User impactSearch queries, target URLs, and extraction/map parameters are sent to the configured Tavily-compatible endpoint.

RecommendationDo not include confidential information in search queries or extracted URLs, and verify `TAVILY_API_BASE` is unset or points to a trusted endpoint.