Security audit
Security checks for vulnerabilities and agentic risk
This skill is a small Tavily web-search wrapper that sends search queries to Tavily using a user-provided API key, with no evidence of hidden persistence or unrelated access.
Install only if you are comfortable sending your search queries to Tavily and providing a Tavily API key via TAVILY_API_KEY. Do not use it for sensitive or confidential queries unless Tavily's handling of that data is acceptable for your use case.
The script performs an outbound network request to api.tavily.com, but that network capability is not covered by declared permissions. In a skill context, undeclared egress is a security issue because it can transmit user input or secrets to external services without transparent consent or enforcement.
The script performs an outbound network request to api.tavily.com, but that network capability is not covered by declared permissions. In a skill context, undeclared egress is a security issue because it can transmit user input or secrets to external services without transparent consent or enforcement.
This code transmits user-controlled input and an authentication secret to an external service over the network. The transmission is over HTTPS and aligns with the skill’s purpose, so it is not inherently malicious, but it is still security-relevant because it exposes data to a third party and increases dependency on external handling of that data.
const query = process.argv[2] ?? "test";
const resp = await fetch("https://api.tavily.com/search", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({ api_key: apiKey, query, max_results: 5, include_answer: true }),
This code transmits user-controlled input and an authentication secret to an external service over the network. The transmission is over HTTPS and aligns with the skill’s purpose, so it is not inherently malicious, but it is still security-relevant because it exposes data to a third party and increases dependency on external handling of that data.
const query = process.argv[2] ?? "test";
const resp = await fetch("https://api.tavily.com/search", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({ api_key: apiKey, query, max_results: 5, include_answer: true }),
The script sends both the user-supplied query and the API key to a third-party service without any user-facing disclosure in the script. Even if expected for functionality, this creates a transparency and privacy risk because users may not realize their input is leaving the local environment and being processed externally.
No suspicious patterns detected.