Tavily Proxy Search

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:29 AM UTC
• Version: 1.0.0

Overview

This skill is a small, disclosed web-search helper for a user-configured Tavily proxy, with a transport-security caveat users should understand.

Install only if you trust the configured TavilyProxyManager endpoint and operator. Prefer a local loopback proxy or an HTTPS URL with a valid certificate, avoid sensitive queries on untrusted proxies, and rotate the master key if it may have been sent over remote plaintext HTTP.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/tavily_proxy_search.py:39

Finding

Bearer credential may be transmitted over unencrypted HTTP

Content

View full analysis

Vulnerability Details

File Location: scripts/tavily_proxy_search.py:39-67
Vulnerability Type: Plaintext transmission of sensitive credentials
Risk Level: Medium

Vulnerable Code

python

def tavily_proxy_search(query: str, max_results: int, include_answer: bool, search_depth: str):
    proxy_url = load_proxy_url()
    master_key = load_master_key()
    if not master_key:
        raise SystemExit(
            "Missing TAVILY_PROXY_MASTER_KEY. Set env var TAVILY_PROXY_MASTER_KEY or add it to ~/.openclaw/.env"
        )

    payload = {
        "query": query,
        "max_results": max_results,
        "search_depth": search_depth,
        "include_answer": bool(include_answer),
        "include_images": False,
        "include_raw_content": False,
    }

    data = json.dumps(payload).encode("utf-8")
    req = urllib.request.Request(
        proxy_url,
        data=data,
        headers={
            "Content-Type": "application/json",
            "Accept": "application/json",
            "Authorization": f"Bearer {master_key}",
        },
        method="POST",
    )

The default endpoint is also explicitly configured with an unencrypted scheme at scripts/tavily_proxy_search.py:10:

python

DEFAULT_TAVILY_PROXY_URL = "http://127.0.0.1:8080/search"

Technical Analysis

The script places TAVILY_PROXY_MASTER_KEY in the HTTP Authorization header and submits it to the user-configurable TAVILY_PROXY_URL. It does not validate the endpoint scheme or restrict unencrypted HTTP to loopback addresses.

The default loopback endpoint substantially limits exposure because traffic normally remains on the local host. However, the documented configuration permits replacing that endpoint, and the implementation will accept a remote http:// URL without warning. When such a URL is used, both the bearer credential and search queries travel without transport enc ...[truncated 2435 chars]

Remediation

View remediation

Remediation Suggestions

1. Parse TAVILY_PROXY_URL with urllib.parse.urlparse before constructing the request.
2. Require the https scheme for every non-loopback endpoint.
3. Permit plaintext HTTP only when the resolved destination is a loopback address such as 127.0.0.1 or ::1.
4. If remote HTTP must be supported for exceptional development environments, require an explicit option such as --allow-insecure-http and emit a prominent warning. Keep this override disabled by default.
5. Continue using Python's default TLS certificate and hostname verification. Do not introduce an unverified SSL context.
6. Document that production deployments must use HTTPS with a valid certificate and that a reverse proxy should terminate TLS if TavilyProxyManager does not do so directly.
7. Rotate the master key immediately if it may previously have been transmitted over an untrusted plaintext connection.
8. Apply least privilege to the proxy key where supported, restrict endpoint access through firewall rules, and monitor for unexpected key usage.
9. Consider rejecting URLs containing embedded user information and validating that the configured path is the expected /search endpoint.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/tavily_proxy_search.py (reported line 19)May include surrounding context.

python

if value:
        return value.strip()

    env_path = pathlib.Path.home() / ".openclaw" / ".env"
    if env_path.exists():
        try:
            txt = env_path.read_text(encoding="utf-8", errors="ignore")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/tavily_proxy_search.py (reported line 47)May include surrounding context.

python

if value:
        return value.strip()

    env_path = pathlib.Path.home() / ".openclaw" / ".env"
    if env_path.exists():
        try:
            txt = env_path.read_text(encoding="utf-8", errors="ignore")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill performs network access, reads environment variables, and may read a local dotenv file, but it does not declare any tool scope or permissions metadata to make those capabilities explicit. This creates a transparency and policy-enforcement gap: an agent or reviewer may invoke the skill without realizing it can access secrets and transmit data off-host to an authenticated proxy.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description explains functionality but omits a clear user-facing warning that search queries and bearer-authenticated requests are sent over the network to a self-hosted proxy. In this context, that matters because queries may contain sensitive research topics and the master key is a high-value secret used to authenticate to an external service, so users need explicit notice before use.

Content

No source excerpt is available for this finding.