ClawHub
Back to skill

Security audit

Tavily Search

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Tavily search wrapper, but it ships and stores API credentials in plaintext, so users should review it before installing.

Review before installing. Remove and revoke the bundled Tavily key, avoid sensitive search queries, and prefer an environment variable or OS credential manager instead of saving your own key in config.json.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
config.json:1
Finding

Hard-Coded Tavily API Credential Stored in Plaintext

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

代码整体确实是在调用 Tavily 搜索 API，具备联网搜索、较深搜索模式（research 通过 advanced depth 实现）、图片搜索，以及结构化 JSON 输出等能力，这些与声明大体一致。但描述中提到“引用生成”，代码并没有单独生成或格式化引用，仅打印来源标题、URL、发布时间和摘要，这更像搜索结果来源展示而非明确的 citation generation 功能。此外，描述强调“专为AI Agent设计”，而实际代码是本地命令行脚本，提供 config/search/research/image 子命令，没有体现专门的 Agent 工具封装、触发器或集成接口。因此存在轻度但明确的描述与实现不完全一致。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

All help text, status messages, and error messages are presented only in Chinese, with no option for users to select another language. This is a natural-language policy issue because it imposes a locale-specific experience without documented opt-in or justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script stores the Tavily API key in a local config.json file in plaintext without permission hardening, encryption, or user warning. On multi-user systems or in insecure workspaces, other local users, backup systems, or malware could read the credential and abuse the associated Tavily account.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
85% confidence
Finding

The script transmits user queries and the API key to an external service at api.tavily.com as part of its intended search functionality. In the context of an agent skill, this matters because prompts, research topics, or other potentially sensitive user data may be sent off-host without explicit consent controls, redaction, or policy checks.

Content

Scanner excerpt · tavily.ps1 (reported line 42)May include surrounding context.

text
}
$config = Get-Content $configPath | ConvertFrom-Json
$apiKey = $config.api_key
$apiUrl = "https://api.tavily.com/search"

# 搜索功能
if ($Command -eq "search" -or $Command -eq "research" -or $Command -eq "image") {

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The help text says the research command supports --max-pages 10, implying pagination or multi-page deep research behavior. However, $MaxPages is only declared as a parameter and is never used in request construction or any other logic; the research mode only switches search_depth to advanced. This is an active documentation-to-code mismatch about the skill's behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This code uses Chinese for comments, CLI descriptions, prompts, and status/error messages throughout the skill, which imposes a specific language on all users. The policy allows fixed locale behavior only when it is justified or when users are given a language/locale choice, neither of which appears here.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · tavily.py (reported line 13)May include surrounding context.

python
sys.stdout = io.TextIOWrapper(sys.stdout.buffer, encoding='utf-8')

CONFIG_PATH = os.path.join(os.path.dirname(os.path.abspath(__file__)), "config.json")
API_URL = "https://api.tavily.com/search"

def save_config(api_key):
    with open(CONFIG_PATH, "w", encoding="utf-8") as f:

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script persistently stores the Tavily API key in a local JSON file beside the code, which increases the chance of accidental disclosure through weak filesystem permissions, backups, logs, packaging, or source-control mistakes. For a search utility, long-term credential storage is not strictly necessary and creates avoidable secret-handling risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The tool transmits user queries, optional raw page content requests, and the API key to an external third-party service over the network. While this is expected for a search skill, it still creates a real data-exposure boundary: sensitive prompts, research topics, or retrieved content may leave the local environment and be processed or logged by the provider.

Content

Scanner excerpt · tavily.py (reported line 81)May include surrounding context.

python
}

        try:
            response = requests.post(API_URL, json=body, timeout=30)
            response.raise_for_status()
            result = response.json()

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest description is written entirely in Chinese and provides no indication that the skill supports other languages or is intentionally limited to a Chinese-speaking audience. Under the policy, language or locale constraints should be optional or explicitly justified when region-specific.

Content

No source excerpt is available for this finding.