Valyu Search

ReviewAudited by ClawScan on May 10, 2026.

Overview

The skill mostly matches its Valyu search purpose, but it has an under-disclosed per-answer spending cap and persists a Valyu API key locally.

Review the Valyu account billing implications before using Answer or DeepResearch, especially because the script sets a 40.0 default data price cap for answers. Prefer configuring VALYU_API_KEY through a secure environment or secret manager rather than saving it locally, and only send files or webhook URLs that you are comfortable sharing with Valyu.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI02: Tool Misuse and Exploitation

What this means

A normal answer request could use more paid Valyu API credits than the user expects.

Why it was flagged

The answer request sets a default maximum data price of 40.0, while SKILL.md does not clearly document this spending limit or require confirmation before use.

Skill content

data_max_price: options.dataMaxPrice || 40.0,

Recommendation

Document the cost cap clearly, expose a user-controlled maximum price option, and require confirmation for higher-cost answer or research requests.

Low

#ASI03: Identity and Privilege Abuse

What this means

The skill needs a Valyu API key to work, but storing it in a local plaintext config file may expose it to anyone or anything with access to that user account.

Why it was flagged

The script can persist the Valyu API key in a local config file, in addition to reading VALYU_API_KEY from the environment.

Skill content

config.apiKey = apiKey;
  writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2));

Recommendation

Prefer a managed secret or environment variable, avoid pasting API keys into chat unless necessary, and rotate the key if it may have been exposed.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Queries, URLs, attached files, and webhook details may be processed by Valyu or delivered through the configured webhook.

Why it was flagged

DeepResearch requests can include URLs, file attachments, and a webhook URL that are sent to Valyu's API.

Skill content

urls: options.urls,
    files: options.files,
    webhook_url: options.webhookUrl

Recommendation

Only submit files, URLs, or webhook endpoints that the user explicitly wants Valyu to process, and avoid sending confidential data unless that is intended.