tavily-due-diligence
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from various external web sources (news, court dockets, regulatory filings) to generate a due diligence memo.
- Ingestion points: Web search results and website content fetched via the
tvlytool (SKILL.md). - Boundary markers: No explicit instructions are provided to the agent to treat fetched data as untrusted or to ignore instructions embedded within the search results.
- Capability inventory: The skill uses
Bash(tvly *)to execute searches and performs file writes to thediligence/directory (SKILL.md). - Sanitization: No sanitization or validation of the external content is mentioned before it is processed by the agent.
- [EXTERNAL_DOWNLOADS]: The skill instructions suggest using
npxto install additional skills from the vendor's repository if they are not already available. - Evidence:
npx skills add tavily-ai/skills --skill <name>(SKILL.md).
Audit Metadata