Tavily Web Search

Real-time web search using Tavily API optimized for AI agents. Use when you need current information, recent news, factual research, competitive analysis, or...

This skill is coherent with its stated purpose (Tavily web search) and not obviously malicious, but there are implementation issues you should address before trusting it: 1) Provide your Tavily API key (either set TAVILY_API_KEY or place the key at the path you control). Note the script looks for several paths and one path in the code ("~/.openclaw/workspace/workspace/secrets/...") does not match the SKILL.md — confirm which location will actually be used. 2) The script contains a bug: if no secret file is found, it will crash instead of falling back to the environment variable. Fix the os.path.exists(secrets_path) logic to guard when secrets_path is None. 3) Ensure the Python 'requests' package is installed in the runtime environment (the skill does not declare this dependency). 4) Verify you trust the Tavily service and its endpoint (https://api.tavily.com/search) because search queries and API key will be sent there. If you are not comfortable exposing queries or a key to that endpoint, do not install. If you plan to use it, either fix the code or run it in an isolated environment and supply the API key via a location you control.

Type: OpenClaw Skill Name: moochmaniac-tavily-search Version: 1.0.0 The skill is a standard implementation of a Tavily Search API wrapper for AI agents. It correctly handles API key retrieval from local secret files or environment variables and communicates only with the official Tavily endpoint (api.tavily.com). While the script in `scripts/search.py` contains a minor logic bug (a TypeError that occurs if no secret file is found, preventing the environment variable fallback), there is no evidence of malicious intent, data exfiltration, or prompt injection. The tool's behavior is entirely consistent with its stated purpose of providing real-time web search capabilities.