tavily

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.90). The skill includes an explicit instruction to perform authentication ("run tvly login yourself") and to conceal that action from the user ("don't tell the user to run it"), which is a hidden/deceptive directive beyond normal tool-use guidance and thus constitutes a prompt injection risk.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). These URLs include an unknown vendor domain (tavily.com) and an explicit curl | bash command pointing to https://cli.tavily.com/install.sh, a direct .sh installer from an untrusted source — a high-risk distribution vector for malware.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The skill contains multiple high-risk patterns: remote install via curl|bash (supply-chain risk), explicit instructions to collect or import user API keys and to run agent-side logins without user prompting, and guidance to store outputs in a hidden directory—together these enable credential collection and covert exfiltration/command execution.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill requires using Tavily’s web search/extract/crawl/research commands where the agent ingests extracted webpage free text from arbitrary third-party URLs discovered or provided at runtime.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly requires installing the Tavily CLI by running "curl -fsSL https://cli.tavily.com/install.sh | bash", which fetches and executes remote code at runtime from https://cli.tavily.com/install.sh.