The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The documentation includes a quick install command: curl -fsSL https://cli.tavily.com/install.sh | bash. This pattern downloads and executes a shell script directly from the internet. In this context, the script is hosted on the vendor's official domain (tavily.com) and is used for its stated purpose of installing the required CLI tool.- [EXTERNAL_DOWNLOADS]: The skill references an external installation script from https://cli.tavily.com/install.sh. As this is a vendor-owned resource used for the skill's primary functionality, it is considered a legitimate dependency.- [COMMAND_EXECUTION]: The skill is configured to use the tvly CLI tool via the Bash tool. The YAML frontmatter correctly scopes this access using allowed-tools: Bash(tvly *), which is a security best practice to limit the command surface to specific vendor tools.- [INDIRECT_PROMPT_INJECTION]: The skill processes synthesis from multiple web sources. This represents an attack surface where untrusted external data (web content) is ingested into the agent's context. The skill relies on the Tavily API's internal processing for synthesis, and standard agent guardrails apply when handling the resulting report.

tavily-research