tavily-extract

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). Most URLs are benign/documentation placeholders (example.com), but the presence of a direct installer script at cli.tavily.com/install.sh — intended to be fetched and piped to bash — is a high-risk pattern from an unverified domain and makes the set suspicious.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). This skill's SKILL.md shows the "tvly extract" command fetching and extracting content from arbitrary public URLs (webpages), so the agent ingests untrusted third-party web content that could contain instructions influencing later decisions.