Qveris

Search and execute dynamic tools via QVeris API. Use when needing to find and call external APIs/tools dynamically (weather, search, data retrieval, stock trading analysis, etc.). Requires QVERIS_API_KEY environment variable.

Security Scan

The skill's code and docs mostly match its stated purpose (calling QVeris to discover/execute tools), but there are several mismatches and risky install instructions that don't add up and warrant caution.

Purpose & Capability

The skill's description, SKILL.md, README, and script all state the tool uses the QVeris API and requires QVERIS_API_KEY — that is coherent with the stated purpose. HOWEVER the registry metadata/requirements block provided with the skill (Requirements: Required env vars: none, Primary credential: none) does not declare the QVERIS_API_KEY. That omission is an incoherence between what the skill needs at runtime and what the manifest declares.

Instruction Scope

The runtime instructions and the bundled script stay within the stated scope: they search and call QVeris API endpoints and require an API key. The script does not attempt to read arbitrary files, other environment variables, or system secrets, and it only sends requests to qveris.ai. The SKILL.md includes auto-invoke triggers for stock/trading queries (expected for this use case).

Install Mechanism

There is no formal install spec, but README instructs installing the 'uv' tool via a remote installer using curl|sh or an inline PowerShell invoke-expression (astral.sh/uv). Encouraging users to run a remote install script (curl | sh / irm | iex) is high-risk. The code expects to be run via 'uv run' and the pyproject lists httpx as a dependency, but required binaries and the installer are not declared in the manifest — another mismatch. No direct malicious artifacts are present in the code, but the recommended install path increases risk.

Credentials

At runtime the only secret the code accesses is QVERIS_API_KEY, which is appropriate for an API-calling tool. However the skill metadata did not declare this required environment variable (registry lists none). That mismatch makes it easier for a user to overlook what secrets will be sent to qveris.ai. No other credentials are requested.

Persistence & Privilege

The skill does not request always:true or attempt to modify other skills or system settings. It is user-invocable and allows autonomous invocation per SKILL.md triggers (auto_invoke), which is expected for a tool that should run when relevant queries appear. There is no indicator it persists credentials beyond reading the environment variable at call time.

What to consider before installing

This skill largely does what it claims: it queries qveris.ai and executes discovered tools using your QVERIS_API_KEY. But there are a few red flags you should consider before installing: - Manifest mismatch: the registry metadata does NOT declare the required QVERIS_API_KEY env var, yet the README, SKILL.md, and script all require it. Verify the manifest and be explicit about which key you provide. - Install risk: the README recommends installing 'uv' with a curl | sh or irm | iex command (astral.sh). Running remote install scripts is risky. Prefer to install from trusted package sources or inspect the installer first, and avoid running it as root. - Key scope: only QVERIS_API_KEY is accessed — do not use a high-privilege or shared secret. Prefer a limited-scope API key that can be revoked and monitor its usage. - Source verification: the skill's Source/Homepage are unknown; confirm the repository owner and provenance before trusting it. If possible, run the script in an isolated environment (container or VM) and inspect network traffic to confirm it only talks to qveris.ai. If you decide to proceed: update the skill manifest to declare QVERIS_API_KEY and any required binary (uv), avoid piping remote scripts into a shell, and test the skill with a scoped, revocable API key in an isolated environment first.

QVeris Tool Search & Execution

QVeris provides dynamic tool discovery and execution - search for tools by capability, then execute them with parameters.

Setup

Requires environment variable:

• QVERIS_API_KEY - Get from https://qveris.ai

Quick Start

Search for tools

uv run scripts/qveris_tool.py search "weather forecast API"

Execute a tool

uv run scripts/qveris_tool.py execute openweathermap_current_weather --search-id <id> --params '{"city": "London", "units": "metric"}'

Script Usage

scripts/qveris_tool.py <command> [options]

Commands:
  search <query>     Search for tools matching a capability description
  execute <tool_id>  Execute a specific tool with parameters

Options:
  --limit N          Max results for search (default: 5)
  --search-id ID     Search ID from previous search (required for execute)
  --params JSON      Tool parameters as JSON string
  --max-size N       Max response size in bytes (default: 20480)
  --json             Output raw JSON instead of formatted display

Workflow

1. Search: Describe the capability needed (not specific parameters)

   • Good: "weather forecast API"
   • Bad: "get weather for London"

2. Select: Review tools by success_rate and avg_execution_time

3. Execute: Call tool with tool_id, search_id, and parameters

Example Session

# Find weather tools
uv run scripts/qveris_tool.py search "current weather data"

# Execute with returned tool_id and search_id
uv run scripts/qveris_tool.py execute openweathermap_current_weather \
  --search-id abc123 \
  --params '{"city": "Tokyo", "units": "metric"}'

Use Cases

• Weather Data: Get current weather, forecasts for any location
• Stock Market: Query stock prices, historical data, earnings calendars
• Search: Web search, news retrieval
• Data APIs: Currency exchange, geolocation, translations
• And more: QVeris aggregates thousands of API tools