web-search-tavily

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). The skill’s runtime workflow calls Tavily endpoints like /search, /extract, /crawl, and /map, which fetch and return cleaned web page text/snippets (outsider-authored public web content) that the agent then includes in its LLM context (e.g., via include_raw_content / raw_content / extracted chunks).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The Tavily endpoints fetch arbitrary, user-supplied web pages at runtime (e.g., the example URL "https://example.com/article1" passed to /extract, /crawl, or /map) and return/expose that page content which is then injected into the agent's responses (i.e., used as model context), so external URLs can directly control prompts.