Valyu Search

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:44 AM UTC
• Version: 1.0.0

Overview

This is a real Valyu web-research helper, but it handles API keys and external data sharing in ways users should review carefully before installing.

Install only if you are comfortable sending research queries, URLs, and any supported file content to Valyu. Configure VALYU_API_KEY yourself through the Gateway environment or another secure secret mechanism; do not paste the key into chat or use the setup command unless you accept plaintext storage in ~/.valyu/config.json and the possibility of command/log exposure.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/valyu.mjs:45

Finding

Valyu API key is accepted through command-line arguments and stored without enforced restrictive permissions

Content

View full analysis

' }, null, 2)); process.exit(1); } try { saveApiKey(apiKey); ``` When no key is configured, the script encourages sharing the credential with the agent: ```javascript message: "I need your Valyu API key to proceed. You can get one at https://platform.valyu.ai — once you have it, just share it with me and I'll set it up for you." ``` ### Technical Analysis The API key is written in plaintext to `~/.valyu/config.json` using `writeFileSync` without an explicit restrictive mode. For newly created files, effective permissions therefore depend on the process umask. In environments with a permissive umask, the file can be readable by other local users. If the file already exists with overly broad permissions, rewriting it does not correct those permissions. The key is also supplied as `scripts/valyu setup `. Command-line secrets may be exposed through shell history, process inspection where permitted, agent command transcripts, execution logs, or monitoring systems that record arguments. Asking the user to share the key in conversation can additiona ...[truncated 1545 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (13)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/valyu.mjs (reported line 17)May include surrounding context.

js

const CONFIG_FILE = join(CONFIG_DIR, 'config.json');

/**
 * Get API key from multiple sources (in order of priority):
 * 1. Environment variable (VALYU_API_KEY)
 * 2. Config file (~/.valyu/config.json)
 */

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The setup-required message explicitly tells the user to share their API key with the agent, normalizing direct secret disclosure in chat. This is dangerous because conversational channels may be logged, retained, or exposed to operators and integrations, turning a setup step into credential exfiltration.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill invokes a Node script that necessarily uses network access and an API key from the environment, but the manifest does not declare explicit tool scope such as permissions or allowed-tools. That weakens least-privilege controls and makes it harder for the platform or reviewer to understand and constrain what the skill is allowed to access, increasing the risk of unintended data exposure or overbroad execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill description and usage text do not warn users that their prompts, supplied URLs, and file attachments may be transmitted to valyu.ai, a third-party service. In this context, the omission is more dangerous because the skill explicitly supports sensitive domains like medical, financial, patent research, and file/URL analysis, creating a meaningful risk of unintentional exfiltration of confidential data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases are very broad, including common requests like 'look up', 'find online', and 'research [topic]', which can cause the skill to activate in many ordinary conversations. Because this skill sends queries, URLs, and potentially files to an external service, over-triggering raises the chance of unnecessary third-party disclosure and unintended network use.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/valyu.mjs (reported line 12)May include surrounding context.

js

import { homedir } from 'os';
import { join } from 'path';

const VALYU_API_BASE = 'https://api.valyu.ai/v1';
const CONFIG_DIR = join(homedir(), '.valyu');
const CONFIG_FILE = join(CONFIG_DIR, 'config.json');

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script accesses and persists an API key in ~/.valyu/config.json even though its stated purpose is web search/content retrieval. Persisting secrets locally expands exposure to other local users, backups, logs, or malware, and this capability is not clearly minimized or justified in the command flow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The API key is written to a persistent plaintext config file without any warning that the credential will be stored locally. Users may disclose and retain sensitive credentials unknowingly, increasing the chance of theft via local compromise, shared accounts, backups, or accidental file exposure.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The setup guidance directs the user to obtain an API key and then run setup with it, coupled with surrounding messaging that the agent should ask for the key. In an agent context, this creates a dangerous pattern where users may reveal credentials directly to the assistant rather than configuring them securely themselves.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The tool transmits user queries, URLs, and extracted content to an external third-party API, but the command flow provides no explicit notice at the time of use. In a research/search skill this transmission is functionally expected, yet lack of disclosure can cause unintentional sharing of sensitive prompts, internal URLs, or proprietary content.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The usage text says the contents command accepts --structured <json-schema>, implying structured extraction behavior. However, the parser assigns the parsed schema to options.summary and the contents API payload has no structured_output field, so the documented behavior contradicts the actual implementation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/valyu.mjs (reported line 315)May include surrounding context.

js

DEEPRESEARCH COMMANDS:
  valyu deepresearch create <query> [options]
    Options: --model <fast|lite|heavy>, --pdf, --json <schema>
    Example: valyu deepresearch create "AI market trends" --model heavy --pdf

  valyu deepresearch status <task-id>
    Example: valyu deepresearch status f992a8ab-4c91-4322-905f-190107bd5a5b

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill text tells the agent to ask for the user's API key and set it up on their behalf, which encourages secret handling by the agent. This expands the trust boundary unnecessarily and can expose credentials through chat history, telemetry, debugging, or mishandling by downstream tooling.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.