Tavily Best Practices

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 3:26 PM UTC
• Version: 1.0.0

Overview

This is a documentation-only Tavily integration guide with expected external API use and package-install cautions, but no hidden, destructive, or purpose-mismatched behavior found.

Install only in an environment where Tavily and any chosen model provider are approved. Do not send secrets, private URLs, regulated data, or proprietary content through search, extract, crawl, research, or LLM-verification examples unless your data policy allows it. Pin and review dependency versions for production use, and leave save_foreign=True disabled unless you intentionally want retrieved web content written to your database.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Third-Party Dependencies Create Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:14-19; references/sdk.md:17,147; references/integrations.md:27,190,263,402,554,620,666
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

SKILL.md:14-19

bash

pip install tavily-python
npm install @tavily/core

references/sdk.md:17,147

bash

pip install tavily-python
npm install @tavily/core

references/integrations.md:27

bash

pip install -U langchain-tavily

references/integrations.md:190

bash

pip install "pydantic-ai-slim[tavily]"

references/integrations.md:263

bash

pip install agno tavily-python

references/integrations.md:402

bash

pip install anthropic tavily-python

references/integrations.md:554

bash

pip install google-adk mcp

references/integrations.md:620

bash

npm install ai @ai-sdk/openai @tavily/ai-sdk

references/integrations.md:666

bash

pip install 'crewai[tools]'

Technical Analysis

The installation instructions do not pin exact dependency versions or verify package integrity with cryptographic hashes. Consequently, package managers resolve mutable versions and their transitive dependency trees at installation time. The -U option used for langchain-tavily explicitly requests an upgrade to the latest version available from the configured registry.

This does not establish that any listed package is currently malicious. However, it prevents the audited Skill from guaranteeing that users will install the same dependency artifacts that were reviewed. If a package, maintainer account, registry, or transitive dependency is compromised, later users could receive attacker-controlled code. Python and Node.js packages may execute package-controlled build or installation behavior and will execute arbitrary library code when imported.

Attack Path

1. An attacker compromises ...[truncated 1394 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace mutable package requirements with exact, reviewed versions, such as package==X.Y.Z for Python and exact versions without range operators for npm.
2. Maintain dependency lockfiles, such as a hash-verified Python requirements file and package-lock.json, npm-shrinkwrap.json, or an equivalent lockfile.
3. For Python, generate requirements with hashes and install using pip install --require-hashes -r requirements.txt.
4. Use npm ci with a committed lockfile for reproducible Node.js installations.
5. Remove -U from routine installation guidance because it intentionally retrieves mutable latest releases.
6. Document the expected package registries and reject untrusted registry overrides in CI/CD environments.
7. Audit direct and transitive dependencies with tools such as pip-audit, OSV-Scanner, or npm audit.
8. Review package provenance, signatures, maintainer changes, and release history before updating pinned versions.
9. Run installation and agent workloads in least-privileged, isolated environments without unnecessary secrets or host filesystem access.
10. Establish a controlled dependency-update process that reviews and tests each version before updating the documented pins and lockfiles.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/integrations.md (reported line 210)May include surrounding context.

md

from pydantic_ai.agent import Agent
from pydantic_ai.common_tools.tavily import tavily_search_tool

# Get API key from environment
api_key = os.getenv("TAVILY_API_KEY")
assert api_key is not None

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill documents search, extraction, crawling, and research operations that inherently transmit user queries, URLs, and potentially other user-supplied content to Tavily's external service, but it does not disclose that data flow or associated privacy implications. In an agentic or RAG setting, this can cause developers to unknowingly route sensitive prompts, internal URLs, or proprietary research targets to a third party.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This markdown file instructs users how to crawl full site content, extract raw page content, images, and discovered URLs, including compliance and knowledge-base use cases. While it mentions performance, cost, and robots.txt, it does not warn that crawling may collect personal, sensitive, or proprietary data from target sites, which is a user-data/privacy-impacting behavior requiring disclosure in markdown descriptions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The integration examples show agents sending queries, URLs, crawled pages, extracted content, and tool-call arguments to Tavily and model providers, but they do not clearly warn developers that user input and fetched content leave the local trust boundary. In agentic and RAG contexts, this can lead to unintentional disclosure of sensitive prompts, internal URLs, proprietary documents, or regulated data to third-party services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The Hybrid RAG example shows save_foreign=True, which persists web-fetched content into a MongoDB collection. In this markdown reference, that behavior is demonstrated without any nearby warning that external content will be stored locally, which could affect user data handling and system state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The example forwards search-result content, titles, and URLs to an external OpenAI API without any warning about third-party data transfer, data retention, or sensitivity review. In an agentic or RAG workflow, search results can contain personal, proprietary, or regulated information, so this pattern can lead developers to exfiltrate data unintentionally.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.