by 安全扫描
OpenClaw
可疑
high confidenceThe skill generally matches a Tavily search integration, but there are several implementation inconsistencies and runtime behaviors (runtime npm fetch, token-cache reading, undeclared binary dependencies) that warrant caution before installing.
评估建议
This skill largely does what it says (Tavily search/crawl/extract/research), but review the following before installing: 1) The scripts rely on tools not listed in metadata (curl, jq, base64, npx). Ensure these binaries are present or install them beforehand. 2) On first run the scripts will call 'npx -y mcp-remote ...' which downloads and executes a package from npm to run an OAuth flow — if you prefer not to fetch code at runtime, set TAVILY_API_KEY manually in your agent settings and avoid th...详细分析 ▾
ℹ 用途与能力
Name/description match the implemented behavior: scripts call Tavily MCP endpoints (https://mcp.tavily.com) for search/crawl/extract/research and can save crawl output to local files. However, the skill metadata only declares 'bash' as a required binary while the scripts also rely on curl, jq, base64, date, and npx at runtime—these are not declared. The scripts also attempt to discover an OAuth token from a local cache (~/.mcp-auth), which is consistent with an OAuth-friendly client but is not documented in the registry metadata as a required config/access.
⚠ 指令范围
Runtime instructions and included scripts will: (a) read files under $HOME/.mcp-auth searching for '*_tokens.json', (b) run npx -y mcp-remote to initiate an OAuth browser flow (downloads and executes code from npm at runtime), (c) make outbound HTTPS requests to mcp.tavily.com, and (d) write crawled pages to any output directory you pass. Reading the local MCP auth cache is scope-relevant for OAuth but may be surprising because it inspects user files and could encounter other token files; the script tries to validate tokens by checking the JWT issuer and expiry, which mitigates but does not eliminate the concern.
⚠ 安装机制
There is no formal install spec, but the scripts call npx -y mcp-remote at runtime. npx will fetch and execute a package from the public npm registry on demand (transient download/execute). That is a moderate-to-high install-time risk compared with an instruction-only script that does not fetch code. The rest of the skill files are local shell scripts (no packaged third-party install), so the primary runtime risk is dynamic npx execution.
ℹ 凭证需求
The skill does not declare any required environment variables in registry metadata, but the scripts use TAVILY_API_KEY if present and will attempt to obtain an OAuth token from ~/.mcp-auth if not. Requesting/using a Tavily API token is proportional to the skill's purpose. Two small issues: (1) TAVILY_API_KEY is optional but not documented in the metadata 'requires.env' (user-facing docs in SKILL.md do mention it), and (2) the script reads ~/.mcp-auth token files — while it filters tokens by issuer and expiry, it still inspects local auth caches which could contain tokens for other tools if stored there.
✓ 持久化与权限
The skill is not always: true and does not request persistent elevated platform privileges. It writes crawl output only to an explicit output directory you pass, and it does not modify other skills or global agent settings. Runtime npx execution is transient and not a declared persistent install.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/7
- Initial release of tavily-search-darry skill. - Integrates Tavily Search API for high-quality web search, news aggregation, and research. - Provides features such as intelligent search, content extraction, relevance scoring, and advanced news filtering. - Includes support for domain filtering and multiple research tools (crawl, extract, research). - Offers shell script examples for basic and advanced usage. - Authentication via Tavily API Key or OAuth.
● 可疑
安装命令 点击复制
官方npx clawhub@latest install tavily-search-darry
镜像加速npx clawhub@latest install tavily-search-darry --registry https://cn.clawhub-mirror.com
技能文档
Tavily 是一个专业的搜索 API，提供高质量、快速、结构化的搜索结果。
功能
网络搜索
- 智能搜索 - LLM 优化的搜索结果
- 内容提取 - 自动提取网页内容摘要
- 相关性评分 - 每个结果带有相关性分数
新闻搜索
- 时间过滤 - 按天、周、月、年过滤
- 域名过滤 - 指定搜索特定网站
- 深度搜索 - basic/advanced 搜索模式
研究工具
- crawl - 网页爬取
- extract - 内容提取
- research - 深度研究
使用方式
基本搜索
./search/scripts/search.sh '{"query": "AI 最新进展", "max_results": 10}'
新闻搜索
./search/scripts/search.sh '{"query": "科技新闻", "time_range": "week", "max_results": 10}'
域名过滤
./search/scripts/search.sh '{"query": "机器学习", "include_domains": ["arxiv.org", "github.com"]}'
子技能
search- 网络搜索crawl- 网页爬取extract- 内容提取research- 深度研究
认证
使用 Tavily API Key 或 OAuth 认证。
获取 API Key: https://tavily.com
Tavily Search, 智能搜索 🔍
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制