tavily-best-practices
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a security-oriented documentation resource for the Tavily API, focusing on official SDK usage and defensive implementation patterns.
- [CREDENTIALS_UNSAFE]: No hardcoded secrets were detected. The skill proactively instructs users to avoid hardcoding API keys and provides examples for secure management using environment variables and the
getpassmodule. - [PROMPT_INJECTION]: The skill specifically addresses the risks of indirect prompt injection from web search results. It includes an 'Anti-Patterns' section and a 'Verification Protocol' that define web content as untrusted and provide strategies for filtering and validating data before it is processed by an LLM.
- [EXTERNAL_DOWNLOADS]: The skill references official and reputable packages including
tavily-python,@tavily/core, and official integrations for frameworks like LangChain, Pydantic AI, and the Vercel AI SDK. These downloads target well-known services and do not pose a supply chain risk.
Audit Metadata