Tavily

• Analyzed: May 11, 2026, 4:58 AM
• Findings: 1
• Version: 0.1.1
• Hash: 9e86b64c2d832cf14bf3b9a55e284691062fab65d61d95086fd3d071cf714d41
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw skill bundle for Tavily web search is benign. It correctly reads the `TAVILY_API_KEY` from environment variables and uses `JSON.stringify` to construct API requests to `https://api.tavily.com/search` in `scripts/tavily_search.js`. There is no evidence of malicious intent, such as data exfiltration to unauthorized endpoints, persistence mechanisms, obfuscation, or prompt injection attempts in `SKILL.md` to subvert the agent's behavior. The code is straightforward and adheres to its stated purpose.