Skip to content
skillsafebeta
← Report library
Purpose / Other

Tavily Search Skill Security Audit

What the author says it does (original text)

|

Independent security check

Security risks found

Files checked
1
Risks found
3
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Search terms are disclosed to the external Tavily service

Source references: 3
What we found

Running `tvly search` necessarily sends the query to Tavily. The Skill has a broad trigger scope but does not tell the agent to remove passwords, tokens, customer data, internal project names, or other confidential material first.

Why this matters

If sensitive material is included in a search request, it may leave the local environment and become subject to Tavily's logging, retention, and account policies.

The Skill explicitly performs external web searches through the Tavily CLI and can activate for a broad range of information requests; the shown command submits the query text. Although it says not to seek an API key before the first request, it does not require removing credentials, customer data, or internal names. Sensitive terms in a user's query could therefore be disclosed to Tavily. A user can ask for the service's retention policy and restrict the agent to sanitized queries.

SKILL.md:4In the instructionsOpen original file
description: |  Search the web with LLM-optimized results via the Tavily CLI. Use this skill when the user wants to search the web, find articles, look up information, get recent news, discover sources, or says "search for", "find me", "look up", "what's the latest on", "find articles about", or needs current information from the internet. Returns relevant results with content snippets, relevance scores, and metadata — optimized for LLM consumption. Supports domain filtering, time ranges, and multiple search depths.allowed-tools: Bash(tvly *)---
Show 2 other places
SKILL.md:32In the instructionsOpen original file
```bash# Basic searchtvly search "your query" --json
SKILL.md:14In the instructionsOpen original file
Run search directly when `tvly` is available. Search supports capped keylessaccess, so do not look for an API key or authenticate before the first request.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Low risk

Browser OAuth is started after keyless usage is exhausted

Source references: 2
What we found

In an interactive session, exhausting the keyless cap triggers `tvly login`, opens browser OAuth, and then retries the search. OAuth may associate the local CLI with the user's account, while the visible material does not state the requested permission scope.

Why this matters

If the user approves the login, search activity may become associated with their Tavily account and the CLI may receive corresponding account access. Browser approval is still required, so the evidence does not indicate silent authorization.

The behavior is conditional: only when the keyless cap is reached in an interactive session does the guidance direct `tvly login`, which opens browser OAuth and then retries the search once; unattended environments are explicitly told not to start it. OAuth involves the user in account authorization, but the visible text does not identify the requested scopes or authorization recipient. Users can verify the account, permissions, and privacy terms on the consent screen and decline unnecessary access.

SKILL.md:18In the instructionsOpen original file
If `tvly` is missing, follow the [tavily-cli setup](../tavily-cli/SKILL.md#setup)before retrying. If the keyless cap is reached in an interactive session, run`tvly login` to open browser OAuth, then retry the original search once. In anunattended environment, report the cap and authentication options instead ofstarting an interactive flow. Do not start a second login immediately afterguided setup has completed.
Show 1 other places
SKILL.md:17In the instructionsOpen original file
If `tvly` is missing, follow the [tavily-cli setup](../tavily-cli/SKILL.md#setup)before retrying. If the keyless cap is reached in an interactive session, run`tvly login` to open browser OAuth, then retry the original search once. In anunattended environment, report the cap and authentication options instead ofstarting an interactive flow. Do not start a second login immediately afterguided setup has completed.
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1
Medium risk

Full-page retrieval can introduce third-party prompt injection into the agent context

Source references: 3
What we found

The Skill recommends `--include-raw-content` to retrieve complete page text. Third parties control that text and may embed content posing as system commands, credential requests, or action instructions; the visible instructions do not require treating it strictly as untrusted data.

Why this matters

If the host agent mistakes page text for instructions, it could depart from the user's task, disclose accessible data, or attempt actions the user did not authorize.

The Skill actively recommends including complete third-party page text in results described as optimized for LLM use. A page author could place disguised instructions in that text, while the visible guidance does not require treating page content solely as untrusted evidence or forbid following embedded action or credential requests. Thus, using this option plausibly exposes later agent decisions to prompt injection. Users can restrict full-content retrieval and require external text to be isolated and handled only as quoted evidence.

SKILL.md:45In the instructionsOpen original file
# Include full page content in resultstvly search "react hooks tutorial" --include-raw-content --max-results 3 --json```
Show 2 other places
SKILL.md:81In the instructionsOpen original file
- **Keep queries under 400 characters** — think search query, not prompt.- **Break complex queries into sub-queries** for better results.- **Use `--include-raw-content`** when you need full page text (saves a separate extract call).- **Use `--include-domains`** to focus on trusted sources.- **Use `--time-range`** for recent information.
SKILL.md:4In the instructionsOpen original file
description: |  Search the web with LLM-optimized results via the Tavily CLI. Use this skill when the user wants to search the web, find articles, look up information, get recent news, discover sources, or says "search for", "find me", "look up", "what's the latest on", "find articles about", or needs current information from the internet. Returns relevant results with content snippets, relevance scores, and metadata — optimized for LLM consumption. Supports domain filtering, time ranges, and multiple search depths.allowed-tools: Bash(tvly *)
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

7 instruction sections

The Skill allows the agent to run Bash commands limited to `tvly` and sends the user's search terms to Tavily to obtain web-search results.

View source
SKILL.md:5In the instructionsOpen original file
  Search the web with LLM-optimized results via the Tavily CLI. Use this skill when the user wants to search the web, find articles, look up information, get recent news, discover sources, or says "search for", "find me", "look up", "what's the latest on", "find articles about", or needs current information from the internet. Returns relevant results with content snippets, relevance scores, and metadata — optimized for LLM consumption. Supports domain filtering, time ranges, and multiple search depths.allowed-tools: Bash(tvly *)---
SKILL.md:32In the instructionsOpen original file
```bash# Basic searchtvly search "your query" --json

The first request uses capped keyless access. When that cap is reached, an interactive session runs `tvly login` and opens browser OAuth; unattended sessions only report the options.

View source
SKILL.md:14In the instructionsOpen original file
Run search directly when `tvly` is available. Search supports capped keylessaccess, so do not look for an API key or authenticate before the first request.If `tvly` is missing, follow the [tavily-cli setup](../tavily-cli/SKILL.md#setup)before retrying. If the keyless cap is reached in an interactive session, run`tvly login` to open browser OAuth, then retry the original search once. In anunattended environment, report the cap and authentication options instead ofstarting an interactive flow. Do not start a second login immediately afterguided setup has completed.

Search can request full page text and can save the JSON response to a local file; these capabilities are optional rather than enabled for every search.

View source
SKILL.md:63In the instructionsOpen original file
| `--include-answer` | Include AI answer (`basic` or `advanced`) || `--include-raw-content` | Include full page content (`markdown` or `text`) || `--include-images` | Include image results || `--include-image-descriptions` | Include AI image descriptions || `--chunks-per-source` | Chunks per source (advanced/fast depth only) || `-o, --output` | Save the JSON response to a file || `--json` | Structured JSON output |
Start here · InstructionsSKILL.md
tavily-search
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:5In the instructionsOpen original file
  Search the web with LLM-optimized results via the Tavily CLI. Use this skill when the user wants to search the web, find articles, look up information, get recent news, discover sources, or says "search for", "find me", "look up", "what's …allowed-tools: Bash(tvly *)---
SKILL.md:32In the instructionsOpen original file
```bash# Basic search
Lines read
96
File checksum (to compare versions)
f4470c13312dfc8729a419326ef2d65903d6488ce1cf7c9005275e8c3ab4a333