Tavily Research

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:27 AM UTC
• Version: 1.0.0

Overview

This appears to be a legitimate Tavily research helper, but it needs Review because it tells agents to automatically run an unverified online installer and start login when the CLI is missing.

Install only if you are comfortable with Tavily CLI use and review the installer separately first. Prefer preinstalling and authenticating the CLI through a trusted, versioned process, and do not let the skill automatically pipe a downloaded script into bash during normal research requests.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:17

Finding

Unverified Remote Installer Is Piped Directly into Bash

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 17
Vulnerability Type: T03: Remote Payload Retrieval and Execution
Risk Level: High

Complete Code Snippet:

bash

curl -fsSL https://cli.tavily.com/install.sh | bash && tvly login

Technical Analysis

The installation instruction downloads a shell script from an external URL and immediately executes it with Bash. The downloaded content is not pinned to a version, saved for inspection, checked against a cryptographic hash, or verified with a trusted signature.

Although the hostname appears consistent with the declared Tavily integration, the repository does not contain the installer or evidence sufficient to verify its current and future contents. The effective executable payload can therefore change after this Skill has been reviewed. Compromise of the remote hosting infrastructure, domain, DNS resolution path, TLS termination, or release process could turn the installer into an arbitrary code-execution mechanism.

The surrounding instructions increase exposure by telling the agent to perform this installation automatically whenever tvly is absent and stating, “Do not skip this step or fall back to other tools.” Installing unreviewed remote code is broader than the minimum privileges required to invoke an already-installed research CLI.

Attack Path

1. A user requests a research task covered by the Skill.
2. The agent checks its environment and does not find tvly on PATH.
3. Following the Skill instructions, the agent retrieves https://cli.tavily.com/install.sh.
4. The response body is streamed directly to Bash without prior inspection or integrity verification.
5. If the delivery infrastructure or installer has been compromised or maliciously changed, attacker-controlled shell commands execute with the same operating-system identity and privileges as the agent.
6. After the script completes successfully, tvly login st ...[truncated 910 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove automatic installation from the Skill workflow. If tvly is unavailable, stop and ask the user to install it through an independently documented and trusted process.
2. Do not pipe network responses directly into a shell. Download the installer to a local file, display or inspect it, and require explicit user approval before execution.
3. Use a version-pinned release artifact rather than a mutable installer endpoint.
4. Verify the artifact using a cryptographic signature from a separately established trust root or a published SHA-256 checksum obtained through an authenticated, independent channel.
5. Prefer a reputable package manager with locked versions and integrity metadata where an official package is available.
6. Run installation with an unprivileged account and avoid sudo or administrator access. Constrain filesystem and network access where sandboxing is available.
7. Replace “Do not skip this step or fall back to other tools” with fail-closed guidance that permits the agent to report the missing dependency without executing remote code.
8. Keep authentication separate from installation and explain what credentials or tokens are created, where they are stored, and what permissions they receive.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The skill instructs the agent to download and execute a remote shell script via curl ... | bash, which is a classic supply-chain and remote code execution risk. This is made more dangerous by the surrounding directive to "Do not skip this step," because it pressures the agent to execute unverified code automatically whenever the CLI is missing.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

If tvly is not found on PATH, install it first:

bash

curl -fsSL https://cli.tavily.com/install.sh | bash && tvly login

Do not skip this step or fall back to other tools.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description contains broad trigger phrases such as "research," "investigate," "analyze in depth," and "compare X vs Y," which can match many ordinary user requests and cause the skill to be invoked more often than intended. In an agentic system, over-broad routing increases the chance of unnecessary tool use, unintended external data access, and execution of the skill's more dangerous behaviors such as installation and networked research.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.