ClawHub
Back to skill

Security audit

Tavily Search Local

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward Tavily search and URL-extraction helper that sends searches and requested URLs to Tavily, with no hidden or destructive behavior found.

Use this only if you are comfortable sharing search queries, requested URLs, and your Tavily API usage with Tavily. Do not send private internal URLs or sensitive content for extraction, and treat returned web page text as untrusted research material rather than instructions for the agent.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The skill metadata says it provides web search results, but this script sends arbitrary user-supplied URLs to Tavily's extract endpoint and retrieves full raw page content. That mismatch is security-relevant because agents or users may authorize a lightweight search capability without realizing the skill can exfiltrate or process complete contents from provided URLs, including internal, private, or sensitive pages if reachable by the third-party service.

External Transmission

Medium
Category
Data Exfiltration
Content
process.exit(1);
}

const resp = await fetch("https://api.tavily.com/extract", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
Confidence
84% confidence
Finding
fetch("https://api.tavily.com/extract", { method: "POST"

External Transmission

Medium
Category
Data Exfiltration
Content
process.exit(1);
}

const resp = await fetch("https://api.tavily.com/extract", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
Confidence
84% confidence
Finding
https://api.tavily.com/

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.