Valyu Search

• Analyzed: May 12, 2026, 3:32 AM
• Findings: 1
• Version: 1.0.0
• Hash: c87a5e9a4cab2d0503e3733349bb8c25d7e2b5bfd0dd225092af73c0dc72de05
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw skill bundle for Valyu Search is benign. It provides a legitimate interface to the Valyu API, handling API keys by reading from environment variables or storing them locally in `~/.valyu/config.json` and sending them to the official `api.valyu.ai` endpoint. The `SKILL.md` instructions are clear and do not contain any prompt injection attempts or instructions for the agent to perform unauthorized actions. The `valyu.mjs` script uses standard Node.js modules and does not exhibit any malicious execution patterns, data exfiltration beyond the intended API interaction, or persistence mechanisms.