tavily-cli

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The two docs links are benign, but https://cli.tavily.com/install.sh is a direct shell-install script (executable download) which can be used to distribute malware if run unreviewed, so it is potentially risky despite appearing to be an official Tavily domain.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The required workflow centers on using the Tavily CLI’s user-invoked tvly search/extract/map/crawl/research commands, where any outsider-authored free text would only be ingested after the user selects specific search queries/URLs and scopes an external fetch, so poison delivery can’t be forced into the workflow by an outsider alone.