tavily
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary purpose is to ingest data from external web sources, which may contain malicious instructions designed to influence the agent's behavior.
- Ingestion points: Web content is retrieved through the search, extract, and crawl methods from external domains as described in SKILL.md and references/api.md.
- Boundary markers: The documentation does not specify the use of delimiters or instructions for the agent to treat fetched data as non-executable text.
- Capability inventory: The agent is granted the ability to read and process information from any accessible website.
- Sanitization: The skill does not mention any filtering or sanitization of the retrieved web content to prevent prompt injection attacks.
- [CREDENTIALS_UNSAFE]: The integration examples for the remote MCP server suggest including the API key in the URL query string, which can lead to credential exposure in logs and network telemetry (references/integrations.md).
- [EXTERNAL_DOWNLOADS]: The skill recommends installing official SDKs and tools from the Tavily registry and common package managers like PyPI and npm (SKILL.md).
- [COMMAND_EXECUTION]: The integration guides provide shell commands for running official Tavily tools using npx (references/integrations.md).
Audit Metadata