Agent Economy ReportAgent Economy ReportCAUTION version 0.1.0 · audited 2026-09-09
This skill lets an agent run web searches through the Tavily search API using a small Python script. It reads a Tavily API key from the TAVILY_API_KEY environment variable, or falls back to reading the line TAVILY_API_KEY=... out of the user's ~/.openclaw/.env file. It then sends the search query plus the key to a single hard-coded destination, https://api.tavily.com/search, and prints the returned titles, URLs and snippets as JSON or Markdown. There is no file writing, no shell execution, no persistence, no obfuscation and no second network destination. The only notable point is that the script parses the user's local .env file, which holds other secrets, though it only extracts the Tavily key line; and search results (untrusted web text) are printed for the agent to read, which is the usual prompt-injection exposure of any search tool.
Instructions try to steer the agent beyond the declared purpose. The script prints third-party web content (titles, URLs, snippets, and Tavily's 'answer' field) straight to stdout for the agent to consume — scripts/tavily_search.py line 107 'lines.append(obj["answer"].strip())' and line 117 'lines.append(f" - {snippet}")'. This is inherent to any search tool, but attacker-controlled page text can reach the agent's context unfiltered. No injection instructions exist in the skill's own text.
| Declared purpose | Perform web searches via the Tavily API as an alternative to Brave web search, returning title/url/snippet results and optional short answers. |
| Observed behavior | Loads a Tavily API key from the environment or ~/.openclaw/.env, POSTs a JSON payload (key + query + options) to https://api.tavily.com/search, parses the response and prints results to stdout in raw JSON, brave-like JSON or Markdown. No other network calls, file writes, or command execution. |
| Verdict, rules only | CAUTION · reads credential-like environment variables: TAVILY_API_KEY |
| Verdict, AI | SAFE |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| network | needed | Single outbound HTTPS POST to https://api.tavily.com/search (scripts/tavily_search.py line 10, 58). No other endpoints. |
| credentials | needed | Reads TAVILY_API_KEY from the environment (line 14) and sends it as the api_key field in the request body (line 41). The key goes only to Tavily. |
| filesystem_read | needed | Reads the whole of ~/.openclaw/.env into memory (line 21) and regex-extracts only the TAVILY_API_KEY line (line 22). Other secrets in that file are read into memory but not used or transmitted. |
| severity | finding |
|---|---|
| info | Single hard-coded network destination All traffic goes to the documented Tavily API endpoint. No hidden or alternate hosts appear anywhere in the package. scripts/tavily_search.py:10 TAVILY_URL = "https://api.tavily.com/search" |
| low | Reads the full local .env secrets file The script loads the entire contents of ~/.openclaw/.env, a file likely containing other API keys, into memory as a fallback for the Tavily key. Only the TAVILY_API_KEY line is extracted (line 22) and nothing else is transmitted, but the read is broader than strictly necessary. scripts/tavily_search.py:21 txt = env_path.read_text(encoding="utf-8", errors="ignore") |
| info | API key sent in request body to Tavily The Tavily key is transmitted to api.tavily.com as required by that API. This matches the skill's declared purpose and its own stated risk note. scripts/tavily_search.py:41 "api_key": key, |
| low | Untrusted web content returned to the agent Search result snippets and answers from arbitrary websites are printed verbatim. An agent reading this output could be influenced by instructions embedded in a malicious page. This is inherent to search tools, not a defect unique to this skill. scripts/tavily_search.py:117 lines.append(f" - {snippet}") |
| info | Result count capped Requested results are clamped between 1 and 10, limiting output size as documented. scripts/tavily_search.py:142 max_results=max(1, min(args.max_results, 10)), |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| api.tavily.com | not in the service index | scripts/tavily_search.py:10 |
| clawhub.ai | not in the service index | skill-card.md:7 |
| Binaries invoked | bash, python3 |
| Environment variables read | TAVILY_API_KEY |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 0 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 48 | 490da2ad7c928df0… |
_meta.json | 6 | ee1ea1b05d4c0de3… |
scripts/tavily_search.py | 159 | a590bf60b0b7bc9e… |
skill-card.md | 38 | 8bc2c9996cc309a5… |
For agents
JSON: https://agenteconomy.report/k/openclaw-tavily-search.audit.json · badge: https://agenteconomy.report/k/openclaw-tavily-search.audited.svg ·
skill rating: /k/openclaw-tavily-search · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).