QVeris Official

PassAudited by ClawScan on May 10, 2026.

Overview

This appears to be a disclosed QVeris API integration that uses one API key and does not show hidden local access, but it can send task parameters to QVeris and invoke discovered external tools.

Install this if you want your agent to use QVeris as an external API tool gateway. Before using it with confidential content, costly operations, or generated media/workflows, confirm which discovered tool will be called and what data will be sent.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

The agent may call QVeris tools and send task parameters externally when it decides the task needs that capability.

Why it was flagged

The skill is designed to let the agent discover and run external tools, and it can be invoked automatically. This is disclosed and purpose-aligned, but it is broad.

Skill content

auto_invoke: true ... QVeris is a **tool-finding and tool-calling engine** ... `call` then runs the selected tool

Recommendation

Use this only if you want QVeris as a general tool gateway; ask the agent to confirm before costly, sensitive, or irreversible tool calls.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

Your QVeris account/API quota may be used for discovery and tool execution calls.

Why it was flagged

The client authenticates to QVeris using the configured API key. This is expected for the service and no unrelated credential use is shown.

Skill content

Authorization: `Bearer ${apiKey}`

Recommendation

Store the QVERIS_API_KEY securely, rotate it if exposed, and monitor QVeris usage or billing if applicable.

NoteMedium Confidence

ASI07: Insecure Inter-Agent Communication

What this means

Sensitive prompts, files, or parameters provided to a selected tool may leave the local environment through QVeris.

Why it was flagged

QVeris acts as a gateway to dynamically discovered tools, so user-supplied parameters may be processed through QVeris and potentially by selected downstream capabilities.

Skill content

QVeris aggregates thousands of tools — it may have what you need

Recommendation

Avoid sending secrets or private data unless you trust QVeris and the selected tool; inspect the discovered tool metadata before calling it.