tavily-key-generator-proxy
Fail
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions require cloning a repository from an unverified source (
https://github.com/skernelx/tavily-key-generator.git) and downloading additional dependencies via pip and Playwright. - [REMOTE_CODE_EXECUTION]: By directing the agent or user to execute
python main.pyafter cloning the untrusted repository, the skill facilitates arbitrary remote code execution. - [COMMAND_EXECUTION]: The provided Python integration snippet (
replenish.py) utilizes thesubprocess.runmethod to execute system commands based on logic triggered by network API responses. - [CREDENTIALS_UNSAFE]: The skill provides instructions for handling administrative passwords and API keys in configuration files (
config.py) and environment variables (.env). It also includes examples of transmitting these credentials in HTTP headers to a locally or remotely hosted proxy server, potentially without encryption.
Recommendations
- HIGH: Downloads and executes remote code from: http://localhost:9874 - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata