Topic Research

Run a second-hop deep research pass through the Tavily CLI after an initial scan, then normalize the result into a local `research.md` contract. Use when Cod...

This skill legitimately wraps a Tavily CLI workflow to produce normalized research reports, but before installing or running it: - Expect to install and trust a third‑party CLI (tvly). Audit the installer (https://cli.tavily.com/install.sh) before running curl | bash. Prefer installing from a reviewed package or vendor documentation if possible. - Confirm the manifest is updated to declare 'tvly' as a required binary so the skill's declared requirements match its runtime needs. - When creating the input markdown, avoid giving an absolute source_file that points outside the project (the skill will read absolute paths). Treat inputs as untrusted and run the skill in a workspace that contains no secrets. - Be aware the skill will write files into content-production/inbox/ and content-production/inbox/raw/research/ and may overwrite existing files. If you need higher assurance, request the author to: (1) add 'tvly' to required binaries in the registry metadata, (2) remove or restrict absolute-path reads for source_file, and (3) avoid recommending curl|bash installs in the README (or provide a pinned, auditable installer).

Type: OpenClaw Skill Name: topic-research Version: 1.0.0 The topic-research skill uses the Tavily CLI to perform deep research and generate reports. It is classified as suspicious due to a path traversal vulnerability in runtime.py; the resolve_source_file function allows the source_file parameter to be an absolute path, which could be exploited to read arbitrary files on the system (e.g., /etc/passwd) if a crafted input markdown is provided. While the README.md suggests a risky curl|bash installation method for the Tavily CLI, there is no evidence of intentional malicious behavior or data exfiltration in the code itself.