Security audit
Security checks for vulnerabilities and agentic risk
This Tavily search skill is coherent and only sends search queries or URLs to Tavily when the user invokes it.
Install this only if you are comfortable sending search queries, URLs you ask to extract, and your Tavily API key to Tavily's API. The reviewed artifact showed no hidden persistence or unrelated local data access.
The skill invokes Node scripts that require environment access (TAVILY_API_KEY) and make outbound network requests, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates a least-privilege and transparency problem: hosting agents may grant broader capabilities than intended, making misuse of secrets or unrestricted network access harder to constrain.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
process.exit(1);
}
const resp = await fetch("https://api.tavily.com/extract", {
method: "POST",
headers: {
"Content-Type": "application/json",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
process.exit(1);
}
const resp = await fetch("https://api.tavily.com/extract", {
method: "POST",
headers: {
"Content-Type": "application/json",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
process.exit(1);
}
const resp = await fetch("https://api.tavily.com/extract", {
method: "POST",
headers: {
"Content-Type": "application/json",
This code sends user-supplied URLs and the API key to a third-party service via an HTTP POST request, but there is no user-facing disclosure beyond the generic usage string. For a code file, transmitting user-provided data to an external service without any visible warning or confirmation meets the missing user warning criterion.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
body.days = days;
}
const resp = await fetch("https://api.tavily.com/search", {
method: "POST",
headers: {
"Content-Type": "application/json",
No suspicious patterns detected.