tavily-hikari-crawl
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
tvly-hikariCLI tool to perform web crawling and results management. - [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection because it ingests and processes content from external websites.
- Ingestion points: Data returned by the
tvly-hikari crawlcommand as described in SKILL.md from external URLs. - Boundary markers: The skill does not provide specific instructions or delimiters to the agent to ignore potentially malicious instructions within the crawled content.
- Capability inventory: The skill allows for command execution (
tvly-hikari) and local file system writes (via the--output-dirargument in SKILL.md). - Sanitization: There are no explicit instructions for sanitizing, filtering, or validating the content retrieved from external sites before it is processed by the agent.
Audit Metadata