The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The script scripts/tavily_search.sh executes npx -y mcp-remote to facilitate the OAuth flow or connect to Tavily's MCP server. This command downloads and executes a package from the npm registry at runtime without version pinning.
[DATA_EXFILTRATION]: The skill accesses sensitive local files in the ~/.mcp-auth directory. The scripts/tavily_search.sh script searches for *_tokens.json files and reads access_token values to authenticate requests to the Tavily API. While intended for its core functionality, this involves accessing credential stores in the user's home directory.
[COMMAND_EXECUTION]: The skill requires the execution of shell scripts and suggests using sudo in its README.md for the installation of system dependencies like curl and jq.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its processing of untrusted external web content.
Ingestion points: Search results and snippets are retrieved from external providers (Google and Tavily) and injected into the agent's context in scripts/gemini_tavily_search.sh and scripts/tavily_search.sh.
Boundary markers: The skill returns data as JSON but does not provide specific instructions or delimiters to the LLM to ignore potentially malicious instructions embedded within the snippets.
Capability inventory: The skill is capable of performing network requests via curl and executing shell commands through its distributed scripts.
Sanitization: The implementation does not perform sanitization, filtering, or escaping of the fetched search results before returning them to the agent.

gemini-tavily-search