Skills tavily-search-free

📦

tavily-search-free

Name: tavily-search-free
Author: Dwsy

Content revision r1 High Risk 🌐 Network access📁 Filesystem access🔑 Env variables⚙️ External commands

Search the Web with Tavily

Fresh web information can be hard to collect and format for LLM work. This skill runs Tavily searches and returns concise results for research and RAG workflows.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "tavily-search-free" from https://skillstore.io/skills/dwsy-tavily-search-free.md and its manifest at https://skillstore.io/api/skills/dwsy-tavily-search-free/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/dwsy-tavily-search-free.md Signed manifest GET /api/skills/dwsy-tavily-search-free/manifest Signed lockfile GET /api/skills/dwsy-tavily-search-free/lockfile

Test it

Using "tavily-search-free". Search for current AI safety regulation updates.

Expected outcome:

A concise list of relevant pages with titles, source links, short summaries, and relevance notes.

Using "tavily-search-free". Compare recent guidance on Python async error handling.

Expected outcome:

A ranked source summary that highlights common recommendations and differences between current references.

Using "tavily-search-free". Find sources for a RAG dataset about electric vehicle charging standards.

Expected outcome:

Candidate source pages with brief content descriptions and notes about usefulness for retrieval ingestion.

Security Audit

High Risk

v7 • 7/5/2026 Open versioned report

Most static findings are documentation false positives, including Markdown backticks, placeholder URLs, example commands, and hidden-path references. Confirmed risks are the runtime handling of TAVILY_API_KEY and external Tavily searches. No prompt injection attempt, obfuscated payload, or evidence of secret exfiltration beyond intended Tavily SDK use was found.

Files scanned

602

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (3)

High

SKILL.md:27

Environment file access

需要 `TAVILY_API_KEY`。密钥已在 `.env` 中预配置。

The documentation states that the API key is preconfigured in .env. That normalizes storing a secret in the skill directory even though the file is not present here.

High

SKILL.md:75

Environment file access

- **配置位置**:`~/.pi/agent/skills/tavily-search-free/.env`

The documentation identifies a .env configuration location under the skill directory. This is documentation-only, but it still directs users to store a credential there.

Medium

scripts/tavily_search.py:15-21

External Network Requests Through Tavily SDK

The script initializes TavilyClient and calls client.search with the supplied query. This sends query text and authentication to an external service.

The TavilyClient initialization and client.search call are direct runtime behavior. The exact endpoint is abstracted by the SDK, but external search service use is clear.

Capability review items (9)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

scripts/tavily_search.py:9

Generic API/secret keys

api_key = os.getenv("TAVILY_API_KEY")

The script reads the TAVILY_API_KEY secret from the environment. It uses the key for Tavily authentication, but a community skill handling secrets is a real risk.

High

scripts/tavily_search.py:15

Generic API/secret keys

client = TavilyClient(api_key=api_key)

The script passes the API key into TavilyClient for external service authentication. This is intended behavior, but it is real third-party credential use.

High

SKILL.md:27

Generic API/secret keys

需要 `TAVILY_API_KEY`。密钥已在 `.env` 中预配置。

The documentation says TAVILY_API_KEY is preconfigured in a dotenv file, which is sensitive credential handling for a distributed skill. No dotenv file was found, so confidence is moderate.

Low

scripts/tavily_search.py:9

Python getenv function

api_key = os.getenv("TAVILY_API_KEY")

The runtime script reads TAVILY_API_KEY from the environment. This is expected for Tavily authentication, but it is real credential access.

Low

scripts/tavily_search.py:9

getenv function call

api_key = os.getenv("TAVILY_API_KEY")

The getenv call retrieves TAVILY_API_KEY at runtime. The access is bounded to Tavily authentication but should be disclosed.

Low

scripts/tavily_search.py:4

dotenv library

from dotenv import load_dotenv

The runtime script imports python-dotenv, enabling local dotenv secrets to be loaded. This is expected but expands the credential surface.

Low

scripts/tavily_search.py:8

dotenv library

load_dotenv()

The runtime script calls load_dotenv before reading the API key. This is real environment-file loading even though it supports the intended authentication path.

Low

scripts/tavily_search.py:4

Python dotenv loader

from dotenv import load_dotenv

The imported dotenv loader is used by the runtime script to support local secret loading. This is legitimate but still credential-handling behavior.

Low

scripts/tavily_search.py:8

Python dotenv loader

load_dotenv()

The load_dotenv call can read values from a local dotenv file. The behavior is expected for this skill but is real environment access.

Risk Factors

🌐 Network access (2)

EXAMPLES.md:20 README.md:76

📁 Filesystem access (21)

🔑 Env variables (17)

README.md:19 README.md:183 README.md:27 README.md:117 README.md:144 scripts/tavily_search.py:9 scripts/tavily_search.py:9 scripts/tavily_search.py:4 scripts/tavily_search.py:8 scripts/tavily_search.py:4 scripts/tavily_search.py:8 scripts/tavily_search.py:9 scripts/tavily_search.py:10 scripts/tavily_search.py:11 scripts/tavily_search.py:15 SKILL.md:22 SKILL.md:27

⚙️ External commands (20)

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/dwsy-tavily-search-free/audits/7?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/dwsy-tavily-search-free/security.svg)](https://skillstore.io/skills/dwsy-tavily-search-free?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/dwsy-tavily-search-free?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/dwsy-tavily-search-free/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/dwsy-tavily-search-free.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

Dwsy. (2026). tavily-search-free security audit report (audit version 7) [Author version unspecified]. Skillstore. https://skillstore.io/skills/dwsy-tavily-search-free/audits/7

BibTeX citation

@techreport{dwsy-dwsy-tavily-search-free-2026,
  author = {Dwsy},
  title = {tavily-search-free security audit report (audit version 7)},
  institution = {Skillstore},
  year = {2026},
  number = {7},
  url = {https://skillstore.io/skills/dwsy-tavily-search-free/audits/7},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "tavily-search-free security audit report (audit version 7)"
version: "unspecified"
type: report
authors:
  - name: "Dwsy"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/dwsy-tavily-search-free/audits/7"
identifiers:
  - type: other
    value: "skillstore:dwsy-tavily-search-free:audit:7"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Research current topics

Gather recent web sources and short summaries for fast topic orientation.

Prepare RAG source discovery

Find candidate pages for retrieval pipelines before deeper ingestion or review.

Investigate technical questions

Search current documentation, comparisons, and troubleshooting notes while coding.

Try These Prompts

Search a topic

Use Tavily to search for recent information about [topic] and summarize the top results.

Compare source perspectives

Search Tavily for [topic] and compare the strongest points from five relevant sources.

Plan RAG ingestion

Run an advanced Tavily search for [domain question]. Return source titles, links, and concise content notes for ingestion planning.

Review time-sensitive evidence

Use Tavily advanced search to gather current evidence about [claim]. Separate confirmed facts, unresolved points, and source caveats.

Best Practices

Use specific search terms and include dates when freshness matters.
Store TAVILY_API_KEY outside committed files and rotate it if exposed.
Review returned sources before using them in reports or datasets.

Avoid

Do not search for private credentials, customer data, or confidential project details.
Do not treat search snippets as verified facts without source review.
Do not commit dotenv files or hardcoded API keys with this skill.