Security audit

Business Operations Tavily Search Business Planner

Security checks for vulnerabilities and agentic risk

Overview

This planning guide has no evident harmful behavior, though broad activation keywords could cause it to appear for unrelated requests.

Expect a general planning workflow rather than a working Tavily search integration. Consider explicit invocation to avoid unrelated activation. The advertised demand score does not establish security or effectiveness.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Activation keywords include common words without a domain-specific scope.

Medium

Category: Trigger Abuse
Confidence: 96% confidence
Finding: The activation keywords include generic terms such as 'public', 'web', 'through', 'return', and 'structured' that do not establish intent to use a Tavily business-planning workflow. If the agent uses these keywords for skill routing, unrelated requests could activate this skill and divert the agent from the user's intended task. The supplied README contains no dangerous execution instructions or data-transfer requirements, so the demonstrated risk is limited to routing and workflow integrity.
Content: No source excerpt is available for this finding.

Generic keywords can activate the skill for unrelated everyday requests.

Medium

Category: Trigger Abuse
Confidence: 99% confidence
Finding: Generic triggers such as "public", "web", "through", and "return" can cause this specialized skill to activate for unrelated requests if routing relies on keyword matching. This can introduce irrelevant workflow instructions and degrade task accuracy, but the supplied skill contains no destructive commands, secret-access requirements, or external data-transfer instructions, limiting the demonstrated impact.
Content: No source excerpt is available for this finding.

Common everyday words are listed as activation keywords without a Tavily-specific scope restriction.

Medium

Category: Trigger Abuse
Confidence: 99% confidence
Finding: Generic activation keywords such as "public", "web", "through", and "return" can cause this skill to be selected for unrelated requests if the host uses these keywords for routing. This creates a low-severity scope-control weakness that could divert tasks into an unintended workflow, but the supplied content contains no destructive actions, exfiltration instructions, or security overrides that would make accidental activation more dangerous.
Content: No source excerpt is available for this finding.

Usage keywords include everyday words without activation constraints.

Low

Category: Trigger Abuse
Confidence: 96% confidence
Finding: The usage keywords include generic terms such as 'public', 'web', 'through', and 'return' without requiring a Tavily-specific request or explicit invocation. If the host uses these keywords for skill selection, unrelated requests could activate the skill and introduce irrelevant instructions or misroute tasks; the metadata's similarly broad activation language reinforces this risk. The supplied README contains no dangerous execution or data-transfer instructions, so the demonstrated impact is limited to routing and workflow integrity.
Content: No source excerpt is available for this finding.

Implicit invocation is enabled, but the description does not define a clear activation scope.

Low

Category: Trigger Abuse
Confidence: 91% confidence
Finding: Implicit invocation is enabled while the supplied skill description includes broad triggers such as "search," "public," and requests for a checklist or analysis, making activation possible for unrelated tasks. This creates a low-risk scope-control weakness that could introduce irrelevant instructions into an agent's workflow; however, the provided file contains no malicious instructions, privileged operations, or evidence of data exfiltration.
Content: No source excerpt is available for this finding.

Usage keywords include common words without a required Tavily-specific context.

Low

Category: Trigger Abuse
Confidence: 90% confidence
Finding: The usage keywords include generic terms such as "public", "web", "through", and "return" without requiring Tavily-specific context, potentially causing unintended activation if the router uses these signals. The metadata reinforces this overly broad scope, allowing unrelated requests to be diverted into this skill's workflow. The supplied file contains no destructive actions, credential access, or exfiltration instructions, so the demonstrated risk is limited to routing reliability and unwanted workflow influence.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.