Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add conn-castle/agent-layer --skill tavily-webgit clone --depth 1 https://github.com/conn-castle/agent-layerWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/conn-castle/agent-layer/tavily-web)<a href="https://agentmods.dev/skills/conn-castle/agent-layer/tavily-web"><img src="https://agentmods.dev/badge/skills/conn-castle/agent-layer/tavily-web.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00063 | $0.01234 |
| Opus 5 | $0.00032 | $0.00617 |
| Sonnet 5 | $0.00013 | $0.00247 |
| Haiku 4.5 | $0.00006 | $0.00123 |
Grade C, and why
tavily-web scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
- Do not install Tavily from this skill. Do not run `curl | bash`, package managers, or login commands unless the user explicitly asks for setup help. Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- Do not install Tavily from this skill. Do not run `curl | bash`, package managers, or login commands unless the user explicitly asks for setup help. How it starts
The opening of the file, as written. The whole thing — 107 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Tavily Web
Use the Tavily CLI as Agent Layer's web retrieval path. Route the request to the smallest useful Tavily command, then summarize the sourced result.
Defaults
- Use
tvly searchfor general web discovery when no URL or known site is provided. - Use
tvly extractdirectly when the user provides exact URLs. - Use
tvly maponly when the user provides a known site/domain and needs URL discovery. - Use
tvly researchonly when the user wants cited synthesis, comparison, or report-style analysis. - Prefer
--jsonwhen the CLI supports it so results can be parsed before summarizing.
Global constraints
- Run
tvly --helpbefore the first Tavily command in a session, then runtvly --statusto verify readiness. - Treat installed CLI help as the source of truth for commands, arguments, flags, output modes, and defaults.
- If
tvlyis missing, unauthenticated, or exits non-zero, stop and tell the user to install or authenticate the Tavily CLI. - Do not install Tavily from this skill. Do not run
curl | bash, package managers, or login commands unless the user explicitly asks for setup help. - Do not use Tavily MCP or Fetch MCP as a fallback.
- Do not use
tvly crawlin the default Agent Layer workflow. - When saving output or scratch data, write under
.agent-layer/tmp/. - Before using non-obvious flags, run
tvly <command> --helportvly research <subcommand> --help; do not rely on memorized CLI syntax.
Required artifacts
- No artifact is required for quick lookups.
- If saving intermediate retrieval output, use
.agent-layer/tmp/tavily-web.<run-id>.<type>.jsonor.agent-layer/tmp/tavily-web.<run-id>.<type>.md. - Final answers that depend on web retrieval must name or cite the source URLs used.
Human checkpoints
- Ask before installing the Tavily CLI, running login/authentication commands, or changing Tavily configuration.
- Do not ask for permission merely to run read-only
tvly search,tvly extract,tvly map, ortvly researchcommands.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 107 lines · 63 tokens per session scan C 88777362f386
tavily-web is a skill published in the GitHub repository conn-castle/agent-layer (10 stars, last pushed yesterday), licensed MIT. It adds 63 tokens to every session and 1,234 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
test-data-generator
A test-data generator for creating datasets from field constraints, business rules, and testing goals. It includes normal, boundary, and invalid values in several data formats.
requirement-analysis
A workflow for analysing requirements from text, PDFs, images, or other business materials.
test-case-design
A tool for turning a test strategy into formal, structured test cases that can be run.
test-case-persistence
A procedure for saving test cases so they can be used again later. It also defines when the procedure starts, what it needs first, and how it should run.
test-strategy
A test-planning procedure that turns requirements into a short test strategy and ranks the important checks by priority.
output-formatter
A workflow for putting reviewed testing materials into a small, formal delivery format.