← 返回 Skills 市场

Tavily Search Secure

Name: Tavily Search Secure
Author: fabekar

作者 fabekar · GitHub ↗ · v1.0.0

cross-platform ⚠ suspicious

918

总下载

当前安装

版本数

在 OpenClaw 中安装

/install tavily-search-secure

功能描述

Tavily API ile güvenli web arama ve URL içerik çıkarma yap. Use when: hızlı web araştırması, kaynaklı sonuç toplama, belirli URL'lerden metin çekme ve özetle...

安全使用建议

This skill's code appears to do what it says: call Tavily's search/extract endpoints and enforce URL safety checks. Before installing: (1) verify the TAVILY_API_KEY will be provided and treat it as sensitive — the scripts send it to api.tavily.com in request bodies; do not reuse high-privilege keys. (2) Confirm the Tavily service/domain is trustworthy (there's no homepage or source URL listed). (3) Fix the registry metadata mismatch (it should declare TAVILY_API_KEY as a required env var / primary credential). (4) Run the scripts in a sandboxed environment or with least-privilege network rules (restrict egress to the Tavily API) and review request/response logs. If you cannot verify the Tavily endpoint or provenance of the skill, do not supply production credentials — use a throwaway key or decline installation.

功能分析

Type: OpenClaw Skill Name: tavily-search-secure Version: 1.0.0 The skill bundle is benign. It provides secure web search and URL content extraction using the Tavily API. The `SKILL.md` file includes explicit security rules, which are robustly implemented in `scripts/extract.mjs` and `scripts/search.mjs`. Key security features include strict URL validation (rejecting private IPs, loopback, localhost, and non-http/https protocols to prevent SSRF), sanitization of all inputs and outputs, and proper handling of the API key via environment variables. There is no evidence of malicious intent, data exfiltration beyond the stated purpose, or prompt injection attempts against the agent.

能力评估

ℹ Purpose & Capability

Name/description, SKILL.md, and the two scripts are coherent: both scripts call https://api.tavily.com (search and extract) and implement the functionality described. However, the registry metadata lists no required environment variables while the SKILL.md and scripts clearly require TAVILY_API_KEY — a bookkeeping/integrity mismatch.

✓ Instruction Scope

SKILL.md directs the agent to run the provided node scripts with a TAVILY_API_KEY. The scripts only perform network calls to api.tavily.com, validate and sanitize inputs, and output results. They explicitly avoid printing the API key and perform host/IPv4/IPv6 checks to block localhost/private addresses (reducing SSRF risk). The scripts do not read other files or secrets.

✓ Install Mechanism

No install spec (instruction-only + included scripts). No external downloads or package installs; code ships in the skill bundle. Risk from install mechanism is low.

⚠ Credentials

Functionally the skill only needs one credential (TAVILY_API_KEY), which is proportionate. But the registry metadata incorrectly lists 'Required env vars: none' and 'Primary credential: none' while SKILL.md and the scripts require TAVILY_API_KEY. That mismatch could be accidental but makes it harder to audit/automate safe deployment and lowers trust. Also there is no homepage or known source listed to verify the Tavily API/service.

✓ Persistence & Privilege

always:false and no behavior that modifies other skills or system settings. The skill does not ask to persist tokens or change agent configuration. Autonomous invocation is enabled by default (normal) but not combined with other red flags here.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install tavily-search-secure
安装完成后，直接呼叫该 Skill 的名称或使用 /tavily-search-secure 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

Rebuilt with security hardening (SSRF blocks, strict URL validation, timeout bounds, sanitized output, no key leakage).

元数据

Slug tavily-search-secure

版本 1.0.0

许可证 —

累计安装 8

当前安装数 6

历史版本数 1

常见问题

Tavily Search Secure 是什么？

Tavily API ile güvenli web arama ve URL içerik çıkarma yap. Use when: hızlı web araştırması, kaynaklı sonuç toplama, belirli URL'lerden metin çekme ve özetle... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 918 次。

如何安装 Tavily Search Secure？

在 OpenClaw 或 Claude Code 对话框中运行命令「/install tavily-search-secure」即可一键安装，无需额外配置。

Tavily Search Secure 是免费的吗？

是的，Tavily Search Secure 完全免费（开源免费），可自由下载、安装和使用。

Tavily Search Secure 支持哪些平台？

Tavily Search Secure 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。

谁开发了 Tavily Search Secure？

由 fabekar（@fabekar）开发并维护，当前版本 v1.0.0。