Gemini Tavily Search

Use this skill when the user asks about current events, real-time information, recent news, live scores, financial data, price updates, recent changes, or an...

Security Scan

The skill's code and instructions are consistent with a Gemini-first / Tavily-fallback web search tool, but the package metadata omits required CLI tools and environment variables and one of the included scripts appears truncated, so verify before use.

Purpose & Capability

The skill implements web search orchestration (Gemini primary, Tavily fallback) and the scripts call the expected endpoints (generativelanguage.googleapis.com and api.tavily.com). However the registry metadata claims no required env vars or binaries while README/SKILL.md and the scripts require GEMINI_API_KEY, TAVILY_API_KEY and the CLI tools curl and jq. That mismatch is an incoherence to resolve.

Instruction Scope

SKILL.md and the scripts limit actions to: classify whether web is needed, call Gemini (optionally with google_search grounding), and fall back to Tavily. The scripts only perform network calls to the stated providers, sanitize/redact sensitive patterns from queries, and normalize output to JSON. I saw no instructions to read unrelated local files or to send data to unknown endpoints.

Install Mechanism

This is an instruction-only skill with shell scripts (no installer). No downloads or archive extraction are used. The only risk is runtime network I/O to provider APIs, which is expected for this skill type.

Credentials

Requesting GEMINI_API_KEY and TAVILY_API_KEY is appropriate for a Gemini+Tavily search orchestrator. The scripts also require curl and jq. The problem is that the registry/metadata at the top incorrectly lists 'none' for required env vars and binaries — that inconsistency should be fixed before trusting automated installation.

Persistence & Privilege

The skill does not request always:true or modify system or other skills' configs. It runs as on-demand scripts and does network calls; autonomous invocation is allowed by default but not an additional privilege in this package.

Assessment

This skill appears to be what it says: a Gemini-first web search with automatic Tavily fallback. Before installing: 1) Confirm you are willing to provide GEMINI_API_KEY and TAVILY_API_KEY (these are required for full functionality) and understand that the scripts will call generativelanguage.googleapis.com and api.tavily.com. 2) Ensure curl and jq are present on the host (README and scripts require them); the registry metadata incorrectly omits these requirements. 3) Note one of the included scripts (gemini_tavily_search.sh) was truncated in the provided bundle—inspect the full script locally to ensure there is no additional unexpected behavior. 4) The scripts redact obvious secrets in queries, but that is not a guarantee against exfiltration; if you are concerned about secret leakage, run the skill in an isolated environment or remove/replace provider keys with limited-scope credentials. 5) If you need transparency about fallback behavior, be aware SKILL.md instructs the agent not to describe fallback logic to users; consider modifying that requirement if you prefer full disclosure. If you want, I can: (a) re-check the full (untruncated) scripts, or (b) produce a checklist of the exact commands the scripts will run for a given sample query.

Purpose

Provide reliable, up-to-date web information using a resilient multi-provider strategy:

Gemini (primary, optional google_search grounding)
→ automatic fallback → Tavily

The agent always receives normalized JSON output and never raw provider errors.

Activation Criteria

Use this skill ONLY when:

• The question involves current or recent information
• News, events, live scores, financial updates
• Time-sensitive data
• Facts that may have changed recently
• Verification against authoritative sources is required
• The model may not have the latest information in its training data

Do NOT Activate When

Do NOT use this skill when:

• The question is stable general knowledge
• Historical facts that do not change
• Conceptual explanations
• Code-related tasks
• Local file operations
• Documentation already available in context
• Another more specific skill is better suited

Internal Logic

1. Perform a lightweight Gemini classification call to determine if web search is required.
2. If web search is NOT required → answer directly via Gemini without tools.
3. If web search IS required → call Gemini with google_search tool enabled.
4. If Gemini fails for ANY reason (timeout, quota error, HTTP error, invalid JSON, API error object, malformed response):
   • Automatically execute Tavily fallback.
5. Normalize provider output into unified JSON schema.
6. Always return valid structured JSON.

The agent must not describe fallback logic to the user.

Input

Call the script with a single JSON argument.

Required

• query (string)

Optional (forwarded to Tavily if fallback occurs)

• search_depth
• topic
• max_results
• time_range
• start_date
• end_date
• include_domains
• exclude_domains
• country
• additional Tavily-compatible parameters

Environment Requirements

Required:

• TAVILY_API_KEY
• GEMINI_API_KEY

Optional:

• GEMINI_MODEL (default: gemini-2.5-flash-lite)

{
  "env": {
    "GEMINI_MODEL": "gemini-2.5-flash-lite",
    "GEMINI_API_KEY": "your-gemini-key",
    "TAVILY_API_KEY": "your-tavily-key"
  }
}

Output Schema (Unified)

The tool always returns JSON in this format:

{
  "provider": "gemini | tavily",
  "answer": "text or null",
  "results": [
    {
      "title": "Source title",
      "url": "https://example.com",
      "snippet": "Relevant excerpt"
    }
  ],
  "fallback": true | false
}

If both providers fail:

{
  "provider": "tavily",
  "answer": null,
  "results": [],
  "fallback": true,
  "error": "tavily_failed"
}

Post-Processing Requirement

After generating the final answer for the user, append:

Searched with: <provider>

Where <provider> matches the returned JSON:

• "gemini"
• "tavily"

If no web search was used:

Searched with: none