Yves Web Search

• Verdict: Pass
• Confidence: High
• Analyzed: Feb 20, 2026, 5:17 PM
• Findings: 0
• Version: 1.0.1

Overview

The skill's files and runtime instructions are consistent with a web-search-and-fetch utility; nothing requests unrelated credentials or hidden capabilities, though there are minor documentation mismatches to note.

This skill appears to do what it says: search and fetch web pages using r.jina.ai, DuckDuckGo Lite, or a local ddgs Python client. Before installing/using: 1) Note the optional JINA_API_KEY — if you export this key, the script will send it to jina.ai endpoints; only set keys you trust. 2) The Python fallback requires 'pip install ddgs' (normal supply-chain risk for PyPI packages); install packages in a virtualenv if concerned. 3) The scripts make outbound HTTP(s) requests (r.jina.ai, lite.duckduckgo.com and the target sites) — if you need to restrict network access, run in a sandbox. 4) The only real mismatch is that JINA_API_KEY is referenced but not listed in the registry's required env vars; this is informational rather than a direct security breach. If you want higher assurance, review the two included scripts yourself or run them in an isolated environment.