🔍 惠迈智能搜索

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:19 AM UTC
• Version: 1.1.0

Overview

This Tavily skill is a coherent web search and extraction helper that clearly uses a Tavily API key and sends user-directed queries or URLs to Tavily.

Install only if you are comfortable sending search queries, research prompts, request IDs, and extraction URLs to Tavily using your Tavily API key. Avoid submitting secrets, private/internal URLs, regulated data, or proprietary context unless your organization permits Tavily for that data, and consider hardening redirect handling before high-trust production use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/tavily.py:63

Finding

Bearer Credential Exposure Through Cross-Origin HTTP Redirects

Content

View full analysis

` header may be copied to the redirected request, including a request to a different origin. The hardcoded initial API base URL prevents direct destination injection, but it does not fully constrain subsequent redirect destinations. The security check is therefore performed too late to reliably protect the credential. ### Attack Path 1. A user or agent invokes any CLI operation, such as `search`, `extract`, `research`, or `usage`. 2. The script creates a request to `https://api.tavily.com` with `TAVILY_API_KEY` in the `Authorization` header. 3. Tavily's endpoint, or infrastructure controlling its response path, returns an HTTP redirect to an attacker-controlled origin. 4. `urllib.request.urlopen()` processes the redirect before control returns to the script. 5. If the r ...[truncated 995 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (17)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md

`SKILL_DIR` is the directory containing this `SKILL.md` file.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill clearly enables network access to an external API, but it does not declare an explicit tool scope such as permissions or allowed-tools. That omission weakens policy enforcement and reviewability, because consumers of the skill cannot reliably tell from the manifest what execution capabilities are intended or authorized.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

No-Script Option (curl)

Use Tavily directly via curl (same endpoints, no bundled script):

bash

curl -s "https://api.tavily.com/search" \

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/bp-search.md (reported line 54)May include surrounding context.

md

### Fast + Ultra-Fast

| Depth        | When to use                                                                                                                                                             |
| ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `ultra-fast` | When latency is absolutely crucial. Delivers near-instant results, prioritizing speed over relevance. Ideal for real-time applications where response time is critical. |
| `fast`       | When latency is more important than relevance, but you want results in reranked chunks format. Good for applications that need quick, targeted snippets.                |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill documentation describes sending URLs and optional queries to Tavily for extraction but does not clearly warn users that this data is transmitted to a third-party service. This can lead to inadvertent disclosure of sensitive URLs, internal resources, or confidential prompts/queries, especially in agent workflows where users may assume processing is local.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 82% confidence

Finding

The file explicitly configures an external endpoint at api.tavily.com, meaning any provided URLs and extraction queries are transmitted off-platform to a third party. While external API use is expected for this skill, it still creates a real data-exposure boundary and can enable SSRF-like access to sensitive internal URLs if upstream callers do not validate user-supplied targets.

Content

Scanner excerpt · references/extract.md (reported line 23)May include surrounding context.

md

optimized for LLMs.
  version: 1.0.0
servers:
  - url: https://api.tavily.com/
security: []
tags:
  - name: Search

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The skill is designed to contact an external service at api.tavily.com using bearer authentication, which creates a real external data transmission path. In agent contexts this is security-relevant because request IDs, prompts, retrieved content, and API credentials may be exposed to a third party, and returned research content may be untrusted.

Content

Scanner excerpt · references/research-get.md (reported line 23)May include surrounding context.

md

optimized for LLMs.
  version: 1.0.0
servers:
  - url: https://api.tavily.com/
security: []
tags:
  - name: Search

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This markdown file describes streaming tool-call events that include executed search queries in real time and later emits discovered source URLs, but it does not warn readers that streamed data may reveal user prompts, research intent, or fetched resources to client logs or downstream consumers. Because SQP-2 applies to markdown files when descriptions omit warnings about privacy-affecting behavior, this is a genuine missing-warning issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation describes a research feature that sends user-provided input to Tavily for processing, but it does not prominently warn users that their prompts and potentially sensitive content will be transmitted to an external third-party service. In an agent skill context, this increases the risk of unintended data exfiltration if users or upstream agents pass secrets, personal data, or internal information into the research task.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 87% confidence

Finding

The skill is explicitly configured to communicate with an external endpoint at api.tavily.com, which means any input passed into this skill leaves the local trust boundary. In isolation this is expected functionality for a web research skill, but it is still a real security concern because agents may forward sensitive prompts, internal URLs, or proprietary context to the third-party service without adequate user awareness or filtering.

Content

Scanner excerpt · references/research.md (reported line 23)May include surrounding context.

md

optimized for LLMs.
  version: 1.0.0
servers:
  - url: https://api.tavily.com/
security: []
tags:
  - name: Search

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill sends user-supplied search queries, and optionally fetched page content, to Tavily's external API but does not present an explicit privacy or data-sharing warning in the skill content. This can lead to unintentional disclosure of sensitive prompts, internal data, or regulated information if users or downstream agents assume processing is local.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The documented endpoint is an external service URL, confirming that data is transmitted off-platform to Tavily. In context this is expected functionality for a web-search skill, but it still creates a real data-exposure boundary because queries, filters, and optionally retrieved content are sent to a third party.

Content

Scanner excerpt · references/search.md (reported line 23)May include surrounding context.

md

optimized for LLMs.
  version: 1.0.0
servers:
  - url: https://api.tavily.com/
security: []
tags:
  - name: Search

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

md

optimized for LLMs.
  version: 1.0.0
servers:
  - url: https://api.tavily.com/
security: []
tags:
  - name: Search

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

optimized for LLMs.
  version: 1.0.0
servers:
  - url: https://api.tavily.com/
security: []
tags:
  - name: Search

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/usage.md (reported line 23)May include surrounding context.

md

optimized for LLMs.
  version: 1.0.0
servers:
  - url: https://api.tavily.com/
security: []
tags:
  - name: Search

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation explicitly directs users to fetch external documentation and throughout the file promotes extracting third-party web content, but it does not warn that URLs, queries, and retrieved content are sent to Tavily and remote websites over the network. In an agent skill context, this can cause unintended disclosure of user prompts, internal URLs, or sensitive targets to external services, especially if the agent uses the skill automatically.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation describes an authenticated API call to an external Tavily endpoint but does not warn users that supplying a request ID and bearer token transmits data to a third-party service. While this is expected behavior for the API, the missing disclosure can mislead users of an agent skill into sending identifiers and credentials off-platform without explicit notice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.