The Agent Skills Directory

[DATA_EXFILTRATION]: The script scripts/tavily_search.sh accesses the sensitive directory ~/.mcp-auth/ to read authentication tokens from *_tokens.json files. This involves local credential harvesting to facilitate API calls.
[EXTERNAL_DOWNLOADS]: The script scripts/tavily_search.sh utilizes npx -y mcp-remote to download and execute code from the npm registry as a fallback mechanism for triggering OAuth flows. While targeting the well-known Tavily service, this represents dynamic package execution at runtime.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from external web sources which may contain malicious instructions designed to influence agent behavior.
Ingestion points: Web search results (titles, snippets, and summary content) retrieved from multiple external APIs including Baidu, Tavily, Brave, and Exa.
Boundary markers: Output results are delimited by plain-text headers (e.g., --- Result 1 ---), which may not be sufficient to prevent an LLM from interpreting embedded instructions as its own.
Capability inventory: The agent utilizing this skill typically possesses high-privilege capabilities such as file system modification and shell command execution.
Sanitization: The skill returns retrieved web content directly to the agent without filtering or sanitizing for natural language instructions.
[COMMAND_EXECUTION]: Multiple scripts within the scripts/ directory use curl to transmit data to external APIs and jq for parsing responses. Specifically, scripts/tavily_search.sh includes logic to start background processes using npx.

web-search