Tavily Research

Conduct comprehensive AI-powered research with citations via the Tavily CLI. Use this skill when the user wants deep research, a detailed report, a compariso...

Security Scan

The skill's purpose (deep research via the Tavily CLI) matches its instructions, but it directs the agent to fetch-and-execute a remote install script and to perform interactive login without declaring credentials — behaviors that are disproportionate and risky for an instruction-only skill.

Purpose & Capability

Name and description claim deep research via the Tavily CLI; the SKILL.md consistently instructs using `tvly research` commands. Requiring the Tavily CLI is coherent with the stated purpose.

Instruction Scope

The instructions explicitly tell the agent to run `curl -fsSL https://cli.tavily.com/install.sh | bash` and `tvly login`. That requires executing arbitrary remote code and performing an interactive login flow; the skill does not declare any credentials or explain what `tvly login` does or which endpoints receive credentials. The SKILL.md also enforces using this specific tool ('Do not skip this step'), reducing fallback options.

Install Mechanism

There is no formal install spec in metadata; instead the runtime docs recommend piping a script from cli.tavily.com into bash. Fetch-and-execute from an external URL is a high-risk install pattern because it runs arbitrary code with the agent's environment and writes binaries to disk; the domain is not a well-known release host referenced in the metadata and no checksums or verification steps are provided.

Credentials

Metadata declares no required credentials, yet the instructions require `tvly login` (an authentication step). The lack of declared primaryEnv or required env vars is a mismatch — users will need to provide credentials at runtime, and it's unclear how those credentials are handled, stored, or transmitted. The skill does not request unrelated secrets, but it fails to document the authentication surface.

Persistence & Privilege

Although the skill itself is not marked 'always' and is user-invocable, the recommended install step will install a persistent CLI on the host (via an external script) without an install spec or reviewable package source in the skill metadata. That persistent install increases blast radius if the fetched script is malicious or compromised.

What to consider before installing

This skill appears to do what it claims (deep research), but it asks the agent to fetch and run a remote install script and to run an interactive login that isn't declared in the metadata. Running curl | bash from an external domain can execute arbitrary code on your system and is the main risk here. Before installing: (1) review the contents of https://cli.tavily.com/install.sh yourself (do not pipe blindly), (2) prefer install sources with verifiable releases/checksums (GitHub releases, package managers), (3) confirm what `tvly login` does and where credentials are sent/stored, and (4) only proceed if you trust the Tavily project and domain. If you want lower risk, ask for a version of the skill that uses an audited package or that documents authentication and provides checksumed releases instead of a curl|bash installer.

AI-powered deep research that gathers sources, analyzes them, and produces a cited report. Takes 30-120 seconds.

Before running any command

If tvly is not found on PATH, install it first:

curl -fsSL https://cli.tavily.com/install.sh | bash && tvly login

Do not skip this step or fall back to other tools.

See tavily-cli for alternative install methods and auth options.

When to use

• You need comprehensive, multi-source analysis
• The user wants a comparison, market report, or literature review
• Quick searches aren't enough — you need synthesis with citations
• Step 5 in the workflow: search → extract → map → crawl → research

Quick start

# Basic research (waits for completion)
tvly research "competitive landscape of AI code assistants"

# Pro model for comprehensive analysis
tvly research "electric vehicle market analysis" --model pro

# Stream results in real-time
tvly research "AI agent frameworks comparison" --stream

# Save report to file
tvly research "fintech trends 2025" --model pro -o fintech-report.md

# JSON output for agents
tvly research "quantum computing breakthroughs" --json

Options

Option	Description
--model	mini, pro, or auto (default)
--stream	Stream results in real-time
--no-wait	Return request_id immediately (async)
--output-schema	Path to JSON schema for structured output
--citation-format	numbered, mla, apa, chicago
--poll-interval	Seconds between checks (default: 10)
--timeout	Max wait seconds (default: 600)
-o, --output	Save output to file
--json	Structured JSON output

Model selection

Model	Use for	Speed
mini	Single-topic, targeted research	~30s
pro	Comprehensive multi-angle analysis	~60-120s
auto	API chooses based on complexity	Varies

Rule of thumb: "What does X do?" → mini. "X vs Y vs Z" or "best way to..." → pro.

Async workflow

For long-running research, you can start and poll separately:

# Start without waiting
tvly research "topic" --no-wait --json    # returns request_id

# Check status
tvly research status <request_id> --json

# Wait for completion
tvly research poll <request_id> --json -o result.json

Tips

• Research takes 30-120 seconds — use --stream to see progress in real-time.
• Use --model pro for complex comparisons or multi-faceted topics.
• Use --output-schema to get structured JSON output matching a custom schema.
• For quick facts, use tvly search instead — research is for deep synthesis.
• Read from stdin: echo "query" | tvly research - --json

See also

• tavily-search — quick web search for simple lookups
• tavily-crawl — bulk extract from a site for your own analysis