The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses curl to perform REST API requests to https://api.tavily.com. These commands are used to facilitate web searches, site mapping, and content extraction as described in the tool mapping section.
[INDIRECT_PROMPT_INJECTION]: The skill fetches and processes untrusted data from the live web, which creates a potential surface for indirect prompt injection attacks.
Ingestion points: Untrusted content is ingested from external URLs via the search, extract, and crawl endpoints described in SKILL.md.
Boundary markers: The skill body does not specify clear delimiters or instructions to the agent to disregard embedded commands within the retrieved web content.
Capability inventory: The skill allows the agent to make network requests and retrieve site data; it does not include capabilities for file system writes, privilege escalation, or arbitrary code execution.
Sanitization: No explicit sanitization or filtering of the retrieved web content (e.g., markdown or raw text) is implemented within the skill's instructions.

tavily