Security audit
Tavily OpenClaw plugin
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent Tavily web search plugin that uses a Tavily API key to perform search and extraction, with no evidence of hidden persistence or unrelated access.
Install only if you want OpenClaw to send search queries and requested extraction URLs to Tavily using your Tavily API key. Review any configured base URL override so traffic goes to the intended Tavily endpoint.
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Static analysis
No suspicious patterns detected.