Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Tavily web-search helper that discloses its external API call and does not show hidden persistence, local data access, or destructive behavior.
Install this only if you are comfortable sending your search queries and selected Tavily request fields to Tavily using your API key. Do not put secrets, credentials, private user data, or long prompt contents in the JSON body; use concise search queries and domain/date filters when possible.
The skill invokes shell-based functionality (curl via a wrapper script) but does not declare any explicit tool scope such as allowed tools or permissions. This creates a governance gap: agents may execute network-capable shell commands without a clear least-privilege contract, increasing the chance of unintended command execution or misuse in broader environments.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
./scripts/search.sh --json '{"query": "NVIDIA stock analysis", "search_depth": "advanced"}'
### Equivalent curl
The script is a thin wrapper around this call:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
if [ -z "$JSON_INPUT" ]; then
echo "Usage: ./search.sh --json '<json>'"
echo ""
echo "The JSON body is sent directly to POST https://api.tavily.com/search"
echo ""
echo "Required fields:"
echo " query: string - Search query (keep under 400 chars)"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
if [ -z "$JSON_INPUT" ]; then
echo "Usage: ./search.sh --json '<json>'"
echo ""
echo "The JSON body is sent directly to POST https://api.tavily.com/search"
echo ""
echo "Required fields:"
echo " query: string - Search query (keep under 400 chars)"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
if [ -z "$JSON_INPUT" ]; then
echo "Usage: ./search.sh --json '<json>'"
echo ""
echo "The JSON body is sent directly to POST https://api.tavily.com/search"
echo ""
echo "Required fields:"
echo " query: string - Search query (keep under 400 chars)"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
if [ -z "$JSON_INPUT" ]; then
echo "Usage: ./search.sh --json '<json>'"
echo ""
echo "The JSON body is sent directly to POST https://api.tavily.com/search"
echo ""
echo "Required fields:"
echo " query: string - Search query (keep under 400 chars)"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
fi
# --- call Tavily REST API -----------------------------------------------
printf '%s' "$JSON_INPUT" | curl -s --request POST \
--url "https://api.tavily.com/search" \
--header "Authorization: Bearer $TAVILY_API_KEY" \
--header 'Content-Type: application/json' \
The script posts the provided JSON payload directly to Tavily's external REST API, which may include user or system data. Although the header comment and usage text describe the API call, there is no runtime confirmation or explicit privacy warning before transmission.
No suspicious patterns detected.