tavily-best-practices

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The Tavily workflow can fetch and ingest arbitrary public web page text at runtime via search(include_raw_content=...), extract(urls=...), or crawl(url=..., instructions=...), and that fetched outsider-authored prose is then returned to the agent/LLM context (e.g., in raw_content/content fields) where it can carry indirect prompt-injection payloads.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The Google ADK integration example configures and calls the remote MCP endpoint https://mcp.tavily.com/mcp/ at runtime (StreamableHTTPServerParams) which returns tool responses that are incorporated into the agent's messages and therefore can directly control agent prompts/behavior.