Tavily Web Search
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill's code and runtime instructions match a Tavily search/extract/map/crawl tool, but multiple metadata and packaging inconsistencies (missing declared env/permissions in the registry, mismatched versions/owners, and differing required binaries) make the package's declarations unreliable — review before installing.
This package appears to be an actual Tavily client (search/extract/map/crawl/research) and needs a TAVILY_API_KEY and network access. However the registry metadata and the contained files disagree about required env vars, binaries, owner, and versions — a red flag for packaging integrity. Before installing: 1) Confirm the skill's publisher (owner IDs differ between registry and _meta.json). 2) Verify you intend to provide TAVILY_API_KEY and are comfortable the agent can use it (network calls to api.tavily.com). 3) Inspect update.py/updateUrl behavior (auto-update could fetch remote code). 4) If you need provenance, ask the publisher for a signed/verified release or install only from a source you trust. If any of these checks fail or you cannot verify the origin, avoid installing or run it in a restricted environment (no API key, no network, or sandbox).
Static analysis
No static analysis findings were reported for this release.
VirusTotal
No VirusTotal findings
Risk analysis
No visible risk-analysis findings were reported for this release.