tavily-best-practices
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill consists of documentation and best practice examples for using the official Tavily Search API. All package references (e.g., tavily-python, @tavily/core) are official or from well-known trusted providers. No suspicious commands, obfuscated code, or unauthorized network operations were found.
- [DATA_EXPOSURE]: No hardcoded credentials or sensitive files are accessed. The skill correctly uses environment variables (e.g., TAVILY_API_KEY) and placeholders (e.g., "tvly-YOUR_API_KEY") in its examples.
- [INDIRECT_PROMPT_INJECTION]: The skill handles untrusted web content from search and crawl results, which is its primary function. 1. Ingestion points: Tavily search, extract, and crawl results (search.md, extract.md, crawl.md). 2. Boundary markers: Absent in prompt examples. 3. Capability inventory: Network API access and database storage examples (sdk.md). 4. Sanitization: The documentation recommends post-filtering strategies such as regex matching and LLM-based verification to sanitize and validate results (search.md).
Audit Metadata