Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Tavily web-search wrapper that sends searches to Tavily and does not show hidden persistence, unrelated local access, or deceptive behavior.
Install this only if you are comfortable sending search queries and your Tavily API key to Tavily. Prefer an environment variable for the key on shared systems, avoid sensitive private queries, and keep any local .secrets/tavily.key file private.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
except Exception:
pass
API_URL = "https://api.tavily.com/search"
DEFAULT_NOISY_DOMAINS = {
"facebook.com",
"m.facebook.com",
The manifest description and introductory sections present bilingual Chinese content by default, which imposes a locale choice in the skill's natural-language interface rather than offering language selection. The policy specifically calls for flagging language or locale constraints when they are not optional or justified as region-specific.
This code sends the search query and API key to the external Tavily API, but the script does not print, prompt, or otherwise explicitly warn the user at execution time that their query will be transmitted to a third-party service. Although the script's purpose is web search, there is no visible runtime disclosure about the outbound data flow.
No suspicious patterns detected.