← Back to Skills Marketplace
95
Downloads
0
Stars
1
Active Installs
1
Versions
Install in OpenClaw
/install tavily-skill-bak
Description
Use Tavily API for real-time web search and content extraction. Use when: user needs real-time web search results, research, or current information from the...
Usage Guidance
The functionality appears to be a simple Tavily API wrapper and the script is short and readable, but there are metadata inconsistencies you should resolve before installing: 1) The skill requires TAVILY_API_KEY (per SKILL.md and tavily-search.sh) yet the registry metadata lists no required credentials — ask the publisher to correct the metadata so required env vars and primary credential are explicit. 2) The ownerId in _meta.json does not match the registry owner ID — verify the publisher's identity or source. 3) Prefer setting the API key in an environment variable rather than storing it in openclaw.json unless you trust that config file's storage and access controls. 4) Inspect or run the included tavily-search.sh in a sandbox to confirm it only calls api.tavily.com and jq, and ensure curl and jq are from trusted system packages. If the publisher cannot explain or fix the metadata/owner mismatch, treat installation as higher risk.
Capability Analysis
Type: OpenClaw Skill
Name: tavily-skill-bak
Version: 1.0.0
The skill provides a wrapper for the Tavily search API but contains a command injection vulnerability in `tavily-search.sh`. The script directly interpolates the `--query` argument into a shell-expanded string within a `curl` command, which allows for arbitrary command execution if the input contains shell metacharacters (e.g., backticks or subshells). While the functionality aligns with the stated purpose, the lack of input sanitization poses a significant security risk.
Capability Assessment
Purpose & Capability
The skill's name, SKILL.md, and tavily-search.sh consistently implement a Tavily web-search integration using curl and jq, which matches the stated purpose. However, the registry metadata lists no required environment variables or primary credential even though the script and documentation require TAVILY_API_KEY; also _meta.json's ownerId differs from the registry owner ID. These metadata mismatches are inconsistent with the stated purpose.
Instruction Scope
SKILL.md and the script limit actions to forming POST requests to https://api.tavily.com/search and printing JSON via jq. The script only reads the TAVILY_API_KEY environment variable and command-line args. There are no instructions to read unrelated files, exfiltrate data to other endpoints, or perform system-wide operations.
Install Mechanism
This is an instruction-only skill with a small shell script and no install spec; nothing is downloaded or written automatically. No high-risk install URLs or archive extraction are present.
Credentials
The skill clearly requires a Tavily API key (TAVILY_API_KEY) per SKILL.md and tavily-search.sh, but the registry's declared required env vars/primary credential fields are empty. Requesting an API key is proportionate to the skill's purpose, but the omission from metadata is a mismatch that could hide what credentials will be used. Also SKILL.md suggests adding the key to an openclaw.json config — that may store secrets persistently and should be considered riskier than using an environment variable.
Persistence & Privilege
The skill does not request persistent 'always' inclusion and does not modify other skills or system configuration. It does not write files or attempt to store credentials itself; it only instructs the user how to set them.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install tavily-skill-bak - After installation, invoke the skill by name or use
/tavily-skill-bak - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release of Tavily Search skill.
- Enables real-time web search and content extraction using the Tavily API.
- Provides clear usage guidance with example queries and scenarios for when to use or not use the skill.
- Includes setup instructions for configuring your Tavily API key via environment variable or OpenClaw config.
- Lists example curl commands for basic search, research, and news queries.
- Details supported API parameters and error handling tips.
- Suggests alternative tools if Tavily API is not available.
Metadata
Frequently Asked Questions
What is Tavily Skill.Bak?
Use Tavily API for real-time web search and content extraction. Use when: user needs real-time web search results, research, or current information from the... It is an AI Agent Skill for Claude Code / OpenClaw, with 95 downloads so far.
How do I install Tavily Skill.Bak?
Run "/install tavily-skill-bak" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Tavily Skill.Bak free?
Yes, Tavily Skill.Bak is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Tavily Skill.Bak support?
Tavily Skill.Bak is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Tavily Skill.Bak?
It is built and maintained by aysun168 (@aysun168); the current version is v1.0.0.
More Skills