tavily-hikari-search
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the
tvly-hikaricommand-line interface to perform web searches and manage configuration. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted data from the open web.
- Ingestion points: Results returned by the
tvly-hikari searchcommand inSKILL.md. - Boundary markers: None; the instructions do not include specific delimiters or warnings to ignore instructions embedded within the search results.
- Capability inventory: Shell command execution via the
tvly-hikaritool. - Sanitization: None; the skill instructs the agent to summarize the JSON result directly without validation or filtering.
- [SAFE]: The skill promotes secure handling of credentials by using a configuration command (
tvly-hikari configure) rather than requiring raw API keys or hardcoded tokens.
Audit Metadata