← Back to Skills Marketplace
360
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install t-web-searcher
Description
AI-optimized web search via Tavily API. Returns concise, relevant results for AI agents.
Usage Guidance
This skill appears to implement a Tavily web-search client and only needs your TAVILY_API_KEY and Node to run — that part is coherent. However, the search script trusts the API's meta.formatFile value and will attempt to import and execute that module at runtime. That means a response from the Tavily API could cause arbitrary code to run in your agent process (or attempt to import local files). Before installing: 1) verify the Tavily domain (api.tavily-search.com) and that you trust the service and owner; 2) consider the metadata mismatch in _meta.json as a minor red flag and confirm provenance; 3) if you must use this skill, run it in an isolated environment (container) and/or audit/patch scripts/search.mjs to only allow known local formatter modules (e.g., whitelist './formatter/*.mjs') rather than importing arbitrary URLs; 4) issue a least-privilege API key to Tavily that can be revoked quickly. If you cannot validate the service or patch the dynamic import behavior, treat this skill as risky and avoid providing sensitive credentials.
Capability Analysis
Type: OpenClaw Skill
Name: t-web-searcher
Version: 1.0.0
The skill contains a significant Remote Code Execution (RCE) vulnerability in `scripts/search.mjs`, where it dynamically imports a JavaScript module using a path derived from the remote API response (`data.meta.formatFile`). Additionally, both `scripts/search.mjs` and `scripts/extract.mjs` employ minor obfuscation by using indirect references to `process.env` (via `process_t` and `key_t` variables) to access the `TAVILY_API_KEY`, a technique often used to evade simple static analysis tools.
Capability Assessment
Purpose & Capability
Name/description, required binary (node), and required env (TAVILY_API_KEY) align with a web-search integration. However, the embedded _meta.json uses a different ownerId/slug than the registry metadata (t-web-searcher vs tavily-search and differing ownerId), which is an inconsistency worthy of note but may be benign (copy/paste or repackaging).
Instruction Scope
SKILL.md and scripts send queries and URLs to Tavily endpoints and only read TAVILY_API_KEY from the environment — that is appropriate. The major concern: scripts/search.mjs reads data.meta.formatFile from the API response and performs a dynamic import(new URL(formatFile, import.meta.url)), which means the service response can cause the local agent process to import and execute a module specified by the API. That can enable remote code execution or execution of arbitrary local files if a crafted URL/path is returned. This grants the remote service significant influence over runtime behavior beyond returning search results.
Install Mechanism
No install spec; code is bundled with the skill and runs via node. No downloads or archive extraction occur during installation, so nothing is fetched at install time.
Credentials
Only TAVILY_API_KEY is required and used by the scripts to authenticate with Tavily API. That credential matches the skill's stated purpose and no unrelated secrets or config paths are requested.
Persistence & Privilege
Skill is not always-enabled and does not request system-wide persistence or modify other skills. It runs only when invoked and does not claim elevated platform privileges.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install t-web-searcher - After installation, invoke the skill by name or use
/t-web-searcher - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release of tavily skill – AI-optimized web search via Tavily API.
- Provides command-line tools for concise, relevant search results and content extraction.
- Supports advanced options: result count, deep research mode, topic selection (general/news), and recency filtering for news.
- Requires TAVILY_API_KEY environment variable.
- Optimized to deliver clean snippets suitable for AI agents.
Metadata
Frequently Asked Questions
What is t-web-searcher?
AI-optimized web search via Tavily API. Returns concise, relevant results for AI agents. It is an AI Agent Skill for Claude Code / OpenClaw, with 360 downloads so far.
How do I install t-web-searcher?
Run "/install t-web-searcher" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is t-web-searcher free?
Yes, t-web-searcher is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does t-web-searcher support?
t-web-searcher is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created t-web-searcher?
It is built and maintained by hhjack (@hhjack); the current version is v1.0.0.
More Skills