Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward Tavily web-search skill, with the main caveat that users should protect the Tavily API key and avoid sending sensitive queries to the external search service.
Install only if you intend to use Tavily as an external search provider. Treat TAVILY_API_KEY as a secret, avoid committing it to repositories or sharing it in logs, and do not include private data, credentials, or confidential business information in search queries.
The skill enables web searches through an external API but does not explicitly warn that user queries will be transmitted to Tavily. This creates a real privacy and data-handling risk because users may unknowingly send sensitive prompts, internal data, or secrets to a third party.
Most of the instructional content and examples are presented in Chinese, and the file does not indicate that the language is optional or region-specific. This can constitute a language policy issue because it effectively forces a specific language without user opt-in or justification.
The documentation tells users to place an API key in config or environment variables but gives no warning that the key is sensitive credential material. This can lead to accidental exposure through checked-in config files, shell history, logs, screenshots, or insecure local storage practices.
No suspicious patterns detected.
