tavily-search

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 3:52 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward Tavily web search integration; it sends searches and URLs to Tavily as expected and does not show hidden persistence, privilege escalation, destructive behavior, or deceptive instructions.

Install only if you are comfortable sending search queries, target URLs, and your Tavily API key to Tavily's service. Avoid using it for secrets, private/internal URLs, regulated data, or sensitive investigation topics unless that third-party disclosure is acceptable for your environment.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The invocation example uses a very broad natural-language trigger ("搜索 XXX 相关信息" / "search information related to XXX"), which can match ordinary user requests rather than an explicit request to use this specific skill. In an agent environment with automatic skill routing, this increases the chance of unintended activation, causing the skill to handle queries when the user did not specifically intend to invoke Tavily search.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill documents use of environment variables and an external web API, which implies access to both env and network capabilities, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization gap: an agent/runtime may grant broader access than intended, making outbound requests or reading secrets without clear policy constraints.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation describes sending an API key, search queries, and URLs to a third-party service but does not warn users that their inputs and secrets will leave the local environment. In an agent skill context, users may unknowingly submit sensitive prompts, internal URLs, or credentials-derived data to Tavily, creating privacy, compliance, and data-handling risks.

External Transmission

Medium

• Category: Data Exfiltration

Content

if exclude_domains is not None:
            payload["exclude_domains"] = exclude_domains

        response = requests.post(endpoint, json=payload, timeout=30)
        response.raise_for_status()
        data = response.json()

• Confidence: 88% confidence
• Finding: This is a real external data transmission point: the code posts the query payload, including API key and user search parameters, to Tavily. While expected for this integration, it is still security-relevant because sensitive user input may leave the local trust boundary.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The search() method sends user queries and optional filters to a third-party API, which can expose sensitive prompts, internal research topics, or proprietary data if callers pass them through unchecked. In an agent skill context, users may reasonably assume local processing unless third-party transmission is clearly disclosed.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The manifest describes a Tavily web search integration focused on search results and AI-powered summarization for RAG/question answering. This file also exposes an `extract` capability that fetches and returns clean content from arbitrary supplied URLs, which is a broader operation than search itself and is not mentioned in the skill description.

External Transmission

Medium

• Category: Data Exfiltration

Content

"include_images": include_images,
        }

        response = requests.post(endpoint, json=payload, timeout=60)
        response.raise_for_status()
        return response.json()

• Confidence: 90% confidence
• Finding: This outbound request sends URLs and extraction options to Tavily's external service, crossing the trust boundary and potentially exposing sensitive targets or metadata. In a skill that may be invoked automatically by an agent, this can be dangerous if private URLs are supplied without validation or user awareness.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The extract() method transmits user-provided URLs to Tavily without any explicit warning, which can leak sensitive internal endpoints, private documents, or investigation targets to a third party. In an agent environment, this can create privacy and operational security issues even if no direct code execution occurs.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The docstring says the helper returns a range from 'yesterday 9:10 to today 9:10', and the daily-summary command repeats that claim, but the code only formats YYYY-MM-DD dates and never sets or preserves a 9:10 time boundary. This is an active contradiction in intent/documentation, not just an omitted detail, because users are told a specific time window is enforced when it is not.

Intent-Code Divergence

Medium

• Confidence: 99% confidence
• Finding: The CLI declares a --format option for the daily-summary subcommand with markdown, numbered, and json choices, implying the command honors caller-selected output formatting. However, the implementation unconditionally calls format_results_numbered(resp), so the documented interface contradicts actual behavior.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This code file performs external network operations through Tavily for search, answer, date-range search, and URL extraction, sending user-provided queries or URLs to a third-party service. While the CLI structure makes the feature purpose somewhat apparent, the file itself provides no explicit warning, confirmation, or user-facing notice that inputs will be transmitted externally.

Natural-Language Policy Violations

Low

• Confidence: 86% confidence
• Finding: The inline comment contains mixed-language wording, implying a locale-specific expectation without any opt-in or explanation. Under the language/locale policy, hardcoded language choices should be optional or clearly justified.

Static analysis

No suspicious patterns detected.