Tavily Best Practices

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 3:05 AM UTC
• Version: 1.0.0

Overview

This is a documentation-only Tavily integration skill whose network and package-install guidance matches its stated purpose, with privacy and supply-chain cautions users should consider.

Before installing or using this skill, treat Tavily as an external service: do not send secrets, internal-only URLs, regulated data, or confidential prompts unless your organization permits it. Pin and review dependency versions in production, and use crawl limits, domain filters, provenance tracking, and storage controls when saving extracted content.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14-22
Vulnerability Type: Unpinned and unverified third-party dependencies
Risk Level: Medium

Vulnerable Code

markdown

**Python:**
```bash
pip install tavily-python

JavaScript:

bash

npm install @tavily/core

text

### Technical Analysis

The installation instructions retrieve the current versions of `tavily-python` and `@tavily/core` without pinning reviewed versions or verifying package integrity. Consequently, the code installed by a user can differ from the code available when this skill was audited.

Package installation can run package build logic, installation hooks, and code from transitive dependencies. If a package release, maintainer account, registry, or transitive dependency is compromised, following these instructions could introduce attacker-controlled code. The project does not provide lockfiles, package hashes, trusted-registry constraints, or an allowlist of reviewed versions.

This finding identifies a supply-chain hardening deficiency. The audited file contains no evidence that either named package is currently malicious.

### Attack Path

1. An attacker compromises a referenced package, one of its transitive dependencies, its maintainer account, or the package registry distribution channel.
2. The attacker publishes a malicious version that satisfies the unconstrained installation command.
3. A user follows the instructions and runs `pip install tavily-python` or `npm install @tavily/core`.
4. The package manager resolves and downloads the malicious release because no version or integrity constraint prevents it.
5. Attacker-controlled code executes through installation/build hooks or when the installed library is imported and used.

### Impact Assessment

Successful exploitation could execute code with the privileges of the user or automation account running the package manager. Depending on that acc
...[truncated 328 chars]

Remediation

View remediation

Remediation Suggestions

• Pin each dependency to a specifically reviewed version rather than installing an unconstrained latest release.
• Supply lockfiles for reproducible installations and update them through a controlled dependency-review process.
• For Python, use a hash-locked requirements file and install it with pip install --require-hashes -r requirements.txt.
• For JavaScript, commit package-lock.json and direct users to use npm ci instead of unconstrained installation.
• Configure package managers to use approved registries and reject unexpected dependency sources.
• Review transitive dependencies and use automated vulnerability and provenance scanning.
• Perform package installation in a least-privileged, isolated environment without unnecessary secrets or host filesystem access.
• Document a controlled process for reviewing and updating pinned versions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs users to initialize and use a third-party Tavily client with an API key and then send queries and URLs to the external service, but it does not warn that search terms, target URLs, and extracted content may leave the local environment. In an agentic or enterprise setting, users may unknowingly transmit sensitive prompts, internal URLs, or proprietary data to Tavily, creating privacy, compliance, and data-governance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The guidance says to omit chunk limits to retrieve full page content for saving to files, but it does not warn about the risks of storing large volumes of external content locally. This can lead to accidental retention of sensitive, copyrighted, malicious, or excessive data, and can also cause storage and downstream processing issues in automated workflows.

Content

No source excerpt is available for this finding.