Tavily Search 1.0.0

• Analyzed: May 12, 2026, 4:02 AM
• Findings: 1
• Version: 1.0.0
• Hash: a77ac1030874dcfd4c105d123c791dc5005ede5c253b2aa3c8103b95544d80d4
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides a straightforward wrapper for the Tavily API, enabling web search and content extraction. It reads the `TAVILY_API_KEY` from environment variables and makes legitimate API calls to `https://api.tavily.com` as intended. There is no evidence of data exfiltration beyond the necessary API key for the service, no malicious execution, persistence mechanisms, or prompt injection attempts against the agent in `SKILL.md`. The scripts `scripts/extract.mjs` and `scripts/search.mjs` correctly parse command-line arguments and interact with the specified external API.