123

AI-optimized web search via Tavily API. Returns concise, relevant results for AI agents.

Security Scan

The skill's code and runtime needs match its stated purpose (Tavily web search) and only request one API key, but registry metadata is odd and the package origin is unclear — verify publisher before installing or using your API key.

Purpose & Capability

The SKILL.md, required binary (node), and the two included scripts implement an AI-focused web search and content extraction via api.tavily.com and only require TAVILY_API_KEY — this aligns with the description. However, registry metadata anomalies (a massively long/garbled slug and a different ownerId in _meta.json) are inconsistent with the declared source and should be verified with the publisher.

Instruction Scope

Runtime instructions tell the agent to run the provided Node scripts which POST queries and URLs to Tavily's API and print results. The instructions and scripts do not read arbitrary local files, other env vars, or send data to endpoints outside api.tavily.com, so scope is limited to the described search/extract functionality.

Install Mechanism

There is no install spec (instruction-only skill with bundled scripts). No downloads or external installers are used; the included JS files are executed by the node binary already required. This is low-risk for hidden install-time actions.

Credentials

Only TAVILY_API_KEY is required and used to call the Tavily API. The key is sent in the JSON body of POST requests to api.tavily.com, which is consistent with a service API key. No unrelated secrets or system credentials are requested.

Persistence & Privilege

The skill does not declare always:true, does not request persistent system-wide changes, and does not modify other skills. Autonomous invocation is allowed by default but not combined with other concerning privileges.

What to consider before installing

What to check before installing or using this skill: - Verify publisher/source: the registry metadata contains a bizarrely long slug and the _meta.json ownerId differs from the provided registry ownerId. Confirm the skill truly comes from Tavily (check tavily.com, official docs, or contact the vendor). - API key exposure: the scripts send your TAVILY_API_KEY in POST bodies to https://api.tavily.com. Only use an API key with limited scope/quotas and avoid using a high-privilege key until you trust the package. - Data privacy: your search queries and any URLs/content you extract will be transmitted to Tavily. Do not send sensitive or confidential data through this skill unless you have confirmed Tavily's privacy/security policies. - Quick code review: the included scripts are short and readable; you can run them locally to inspect behavior. Confirm node version supports global fetch or run in an environment with a safe fetch implementation. - If unsure: do not provide your primary API key. Ask the publisher for provenance, or request a release from an official Tavily repo or package registry. Rotate the key if you test this skill with a real key and then decide not to trust it.

Tavily Search

AI-optimized web search using Tavily API. Designed for AI agents - returns clean, relevant content.

Search

node {baseDir}/scripts/search.mjs "query"
node {baseDir}/scripts/search.mjs "query" -n 10
node {baseDir}/scripts/search.mjs "query" --deep
node {baseDir}/scripts/search.mjs "query" --topic news

Options

• -n <count>: Number of results (default: 5, max: 20)
• --deep: Use advanced search for deeper research (slower, more comprehensive)
• --topic <topic>: Search topic - general (default) or news
• --days <n>: For news topic, limit to last n days

Extract content from URL

node {baseDir}/scripts/extract.mjs "https://example.com/article"

Notes:

• Needs TAVILY_API_KEY from https://tavily.com
• Tavily is optimized for AI - returns clean, relevant snippets
• Use --deep for complex research questions
• Use --topic news for current events