tavily-search-ff2969 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited tavily-search-ff2969 (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use Tavily as an API-backed web_search provider when ArkSpace routes a search task to Tavily or when the user explicitly asks for Tavily search.
Tavily configuration is managed by provider-manager; do not ask the user to edit config files by hand.
https://docs.tavily.com/documentation/agent-skillshttps://docs.tavily.com/api-reference/endpoint/searchhttps://github.com/tavily-ai/skillshttps://docs.openclaw.ai/tools/tavilyhttps://github.com/openclaw/openclaw/tree/main/extensions/tavilyResolve the installed ArkSpace package root before running commands. Replace <installed-arkspace-path> with the directory two levels above this loaded SKILL.md, such as /Users/<user>/.claude/plugins/cache/ark-space/ark-space/0.1.2. Use the installed package path, not a repository-relative command.
Check configuration:
python3 <installed-arkspace-path>/scripts/arkspace.py provider check tavily --capability web_searchSet up Tavily once:
python3 <installed-arkspace-path>/scripts/arkspace.py provider setup tavily --wizardFor multiple API keys:
python3 <installed-arkspace-path>/scripts/arkspace.py provider setup tavily --wizard --key-count 2The provider config stores env:<NAME> references. Raw keys saved through setup live in ArkSpace's local private secrets file, not in committed package files. The agent should help run these commands when the user asks to configure Tavily.
If the provider check reports a missing Tavily API key:
python3 <installed-arkspace-path>/scripts/arkspace.py provider setup tavily --wizard.--wizard through that tool.! python3 <installed-arkspace-path>/scripts/arkspace.py provider setup tavily --wizard in the Claude prompt or terminal, orpython3 <installed-arkspace-path>/scripts/arkspace.py provider setup tavily --save-secret TAVILY_API_KEY --secret-stdin./ark-space:tavily-search <query>.Basic search:
python3 <installed-arkspace-path>/scripts/arkspace.py web search --provider tavily "agent skills" --output jsonSearch with Tavily controls:
python3 <installed-arkspace-path>/scripts/arkspace.py web search --provider tavily "AI coding assistants" \
--search-depth basic \
--max-results 5 \
--topic general \
--time-range month \
--include-domains github.com,docs.tavily.com \
--output jsonregistry/search-providers.yaml before execution.tavily-extract or another web_fetch provider when the user provides a URL to read.include_answer or raw content is explicitly requested.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.