tavily-competitor-analysis
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes data from external competitor websites, providing a surface for indirect prompt injection where malicious text on a website could influence the agent's behavior.
- Ingestion points: Content is extracted from competitor pages and changelogs using
tvly extract. - Boundary markers: No delimiters or instructions are provided to distinguish external content from the skill's system instructions.
- Capability inventory: The agent can execute the
tvlycommand and write files to the local file system. - Sanitization: No sanitization of the extracted content is performed.
- [COMMAND_EXECUTION]: The skill uses the
tvlyCLI tool via Bash for its core functionality of searching and extracting web data.
Audit Metadata