Tavily Skill.Bak

Use Tavily API for real-time web search and content extraction. Use when: user needs real-time web search results, research, or current information from the...

The functionality appears to be a simple Tavily API wrapper and the script is short and readable, but there are metadata inconsistencies you should resolve before installing: 1) The skill requires TAVILY_API_KEY (per SKILL.md and tavily-search.sh) yet the registry metadata lists no required credentials — ask the publisher to correct the metadata so required env vars and primary credential are explicit. 2) The ownerId in _meta.json does not match the registry owner ID — verify the publisher's identity or source. 3) Prefer setting the API key in an environment variable rather than storing it in openclaw.json unless you trust that config file's storage and access controls. 4) Inspect or run the included tavily-search.sh in a sandbox to confirm it only calls api.tavily.com and jq, and ensure curl and jq are from trusted system packages. If the publisher cannot explain or fix the metadata/owner mismatch, treat installation as higher risk.

Type: OpenClaw Skill Name: tavily-skill-bak Version: 1.0.0 The skill provides a wrapper for the Tavily search API but contains a command injection vulnerability in `tavily-search.sh`. The script directly interpolates the `--query` argument into a shell-expanded string within a `curl` command, which allows for arbitrary command execution if the input contains shell metacharacters (e.g., backticks or subshells). While the functionality aligns with the stated purpose, the lack of input sanitization poses a significant security risk.