tavily-market-research

Pass

Audited by Gen Agent Trust Hub on Nov 6, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install additional modular skills (e.g., tavily-research, tavily-list) using the command npx skills add tavily-ai/skills. These modules originate from the same verified author organization and are intended to extend the core functionality of the market research workflow.
  • [COMMAND_EXECUTION]: The skill is configured to use the tvly bash command tool. This tool is used to perform specialized market research queries against external data sources such as the SEC (sec.gov) and industry trackers.
  • [INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection as it actively ingests untrusted data from web search snippets, company filings, and analyst reports.
  • Ingestion points: Data returned by the tvly tool from various external domains, including tracker executive summaries and trade press.
  • Boundary markers: The skill lacks explicit character-based delimiters for untrusted input, although it provides instructional guidance to 'Confirm the extracted text is about the market before using it'.
  • Capability inventory: The agent has the ability to execute the tvly bash command and write report files to the local file system (reports/{title}.md).
  • Sanitization: No programmatic sanitization of external content is specified beyond manual verification of data relevance by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 6, 2026, 09:41 PM