tavily-search

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill communicates with the vendor's API endpoint at api.aisa.one to retrieve search results. This is expected behavior for a search utility and involves communication with the service provider's infrastructure.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external websites via search snippets and summaries.
  • Ingestion points: External content is retrieved in scripts/search_client.py and printed to the standard output.
  • Boundary markers: The output uses clear visual delimiters (e.g., =======) and structured labels to separate results.
  • Capability inventory: The script is a standalone Python client using only the standard library; it lacks capabilities for file system modification, privilege escalation, or arbitrary command execution.
  • Sanitization: The script performs basic content truncation (e.g., snippet[:200]) before displaying information to the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 02:35 AM