Qverisai 1.0.1

Search and execute dynamic tools via QVeris API. Use when needing to find and call external APIs/tools dynamically — covers weather, search, stocks, finance,...

Security Scan

The skill's code and SKILL.md require a QVERIS_API_KEY and only call qveris.ai, but the registry metadata claims no credentials and there are small owner/version mismatches — an inconsistency that should be resolved before trusting the skill.

Purpose & Capability

The skill's name and description (dynamic tool discovery via QVeris) match the code and SKILL.md: the CLI calls https://qveris.ai/api/v1 to search and execute tools across many domains. However the published registry metadata in the header (Required env vars: none, Primary credential: none) contradicts the SKILL.md and the script, which both require QVERIS_API_KEY. There is also a minor ownerId/version mismatch between the registry header and _meta.json.

Instruction Scope

SKILL.md instructs the agent to only use QVERIS_API_KEY and to communicate with https://qveris.ai/api/v1. The included script uses process.env.QVERIS_API_KEY, performs POST requests to /search and /tools/execute, formats output, and does not read other environment variables or local sensitive files. The runtime instructions and implementation are consistent with each other.

Install Mechanism

This is an instruction-only skill with a small Node.js script and no install spec or external downloads. No third-party packages are installed and no files are extracted — low installation risk.

Credentials

The script legitimately needs a single API key (QVERIS_API_KEY) to contact the service; that's proportionate to its purpose. The concern is that the registry metadata does not declare this required credential (saying 'none'), which is an incoherence that could cause silent failures or, worse, accidental exposure if users supply keys assuming different behavior. SKILL.md claims the key is only sent to qveris.ai and never logged; the code appears to follow that, sending the key in an Authorization header and not writing it to disk.

Persistence & Privilege

The skill does not request 'always: true', does not modify other skills' configs, and has no install-time persistence beyond being placed in the skills directory. It can be invoked autonomously by the agent (default), which increases blast radius if the skill had malicious behavior, but the code does not request elevated system privileges or persistent system-wide changes.

What to consider before installing

There are clear packaging/metadata inconsistencies even though the code itself appears to implement the described functionality. Before installing: 1) Confirm the registry metadata is corrected to declare QVERIS_API_KEY as a required credential (so you know to provide a scoped, revocable key). 2) Verify the skill owner and version (ownerId and version mismatch between header and _meta.json). 3) If you proceed, create a scoped, revocable API key at qveris.ai and monitor its usage. 4) Remember the skill can be invoked autonomously by the agent — only enable if you trust qveris.ai and the skill author. If the registry metadata cannot be fixed or the owner/version discrepancy is unexplained, treat the package as untrusted until clarified.

QVeris Tool Search & Execution

QVeris provides dynamic tool discovery and execution - search for tools by capability, then execute them with parameters.

Setup

Requires environment variable:

• QVERIS_API_KEY - Get from https://qveris.ai

No additional dependencies — uses Node.js built-in fetch.

Security

• Credential: Only QVERIS_API_KEY is accessed. No other env vars or secrets are read.
• Network: API key is sent only to https://qveris.ai/api/v1 over HTTPS. No other endpoints are contacted.
• Storage: The key is never logged, cached, or written to disk.
• Recommendation: Use a scoped, revocable API key. Monitor usage at https://qveris.ai.

Quick Start

Search for tools

node scripts/qveris_tool.mjs search "weather forecast API"

Execute a tool

node scripts/qveris_tool.mjs execute openweathermap_current_weather --search-id <id> --params '{"city": "London", "units": "metric"}'

Script Usage

node scripts/qveris_tool.mjs <command> [options]

Commands:
  search <query>     Search for tools matching a capability description
  execute <tool_id>  Execute a specific tool with parameters

Options:
  --limit N          Max results for search (default: 10)
  --search-id ID     Search ID from previous search (required for execute)
  --params JSON      Tool parameters as JSON string
  --max-size N       Max response size in bytes (default: 20480)
  --timeout N        Request timeout in seconds (default: 30 for search, 60 for execute)
  --json             Output raw JSON instead of formatted display

Workflow

1. Search: Describe the capability needed (not specific parameters)

   • Good: "weather forecast API"
   • Bad: "get weather for London"

2. Select: Review tools by success_rate and avg_execution_time

3. Execute: Call tool with tool_id, search_id, and parameters

Example Session

# Find weather tools
node scripts/qveris_tool.mjs search "current weather data"

# Execute with returned tool_id and search_id
node scripts/qveris_tool.mjs execute openweathermap_current_weather \
  --search-id abc123 \
  --params '{"city": "Tokyo", "units": "metric"}'

Use Cases

• Weather: Get current weather, forecasts for any location
• Search: Web search, information retrieval
• Stocks & Finance: Query stock prices, historical data, earnings calendars
• Economics: GDP, inflation rates, economic indicators
• Geolocation: IP lookup, geocoding, reverse geocoding
• AIGC: Image generation, text-to-speech, AI content creation
• News: Headlines, article search, trending topics
• Social Media: Trending topics, post analytics, engagement data
• Health Data: Clinical trials, drug info, health statistics
• And more: QVeris aggregates thousands of API tools