Exchange Rate
PassAudited by ClawScan on May 1, 2026.
Overview
This appears to be a legitimate read-only exchange-rate lookup skill, but it requires a QVeris API key and sends requested currency data to QVeris.
This skill looks coherent for exchange-rate lookup and conversion. Before installing, make sure you trust QVeris with your currency queries, use a revocable API key, and note that the registry metadata may not surface the credential and Node.js requirements even though the README and SKILL.md do.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Your QVeris account key will be used whenever the skill performs lookups, so usage may be attributable to your account.
The script reads a QVeris API key from the environment and uses it as a bearer token for provider API calls. This is expected for the stated service, but it is still credential-backed account access.
const key = process.env.QVERIS_API_KEY; ... Authorization: `Bearer ${apiKey}`Use a scoped, revocable QVeris key if available, and avoid sharing logs or environments that expose the key.
A relevant exchange-rate request may cause the agent to select and call a QVeris tool automatically.
The skill dynamically discovers and executes QVeris-hosted tools instead of using a fixed tool ID. This is central to its fallback design and is limited to currency parameters, but remote tool selection is automatic.
const SEARCH_QUERIES = ["currency exchange rate real-time forex", "currency conversion amount convert"]; ... executeTool(tool.tool_id, tool.search_id, params, MAX_RESPONSE_SIZE, timeoutMs)
Use the skill for exchange-rate tasks only, and review QVeris account activity if you need strict control over external tool usage.
The currency conversion details you ask about may be sent to QVeris and associated with your API key.
The artifacts disclose that requests are brokered through QVeris. Currency pairs, amounts, and optional dates may leave the local agent and be processed by QVeris.
network:
outbound_hosts:
- qveris.ai
...
2. Search QVeris for tools ...
5. Execute chosen tool with 5s timeoutOnly use the skill for exchange-rate queries you are comfortable sending to QVeris.
An installer or registry view may not clearly warn you that the skill needs a QVeris API key and Node.js to run.
The registry metadata under-declares requirements that SKILL.md and README.md disclose, including QVERIS_API_KEY and Node.js usage. This may affect install-time visibility, but it does not show hidden or unrelated behavior.
Required env vars: none ... Primary credential: none ... No install spec — this is an instruction-only skill.
Before installing, confirm you are prepared to provide QVERIS_API_KEY and run the included Node script.