Qveris Skill

Search and execute dynamic tools via QVeris API. Use when needing to find and call external APIs/tools dynamically (weather, search, data retrieval, stock tr...

Security Scan

The skill's code and docs match its stated purpose (search/execute tools via qveris.ai) but the registry metadata omits the required QVERIS_API_KEY and the README suggests installing tooling via curl|sh — these inconsistencies and install instructions warrant caution before installing.

Purpose & Capability

The skill name, description, README, SKILL.md, and the included script all consistently implement 'search and execute tools via QVeris API' and make HTTPS calls to https://qveris.ai. That capability matches the stated purpose. However, the registry metadata claims no required environment variables or primary credential, while SKILL.md and the script both require QVERIS_API_KEY — an inconsistency in declared requirements.

Instruction Scope

Runtime instructions (SKILL.md) direct the agent to search and execute remote tools via the QVeris API and specify the QVERIS_API_KEY. The included CLI only performs network calls to the qveris.ai API and prints results; it does not attempt to read unrelated system files, other env vars, or arbitrary local config. Auto-invocation triggers target stock/trading/analysis queries which is coherent with the use-case.

Install Mechanism

There is no formal install spec (instruction-only skill), which lowers risk. The repo includes a Python script and pyproject dependency (httpx). The README recommends installing 'uv' using a curl|sh installer (astral.sh), which is a common but higher-risk pattern because it runs remote install scripts. No other external downloads or obscure URLs are present in the packaged files.

Credentials

The script and SKILL.md require a QVERIS_API_KEY environment variable (used as a Bearer token to qveris.ai). That credential is proportionate to the declared function. However, the registry metadata incorrectly lists no required env vars/credentials — this mismatch is concerning because metadata is what permission prompts and installers rely on. Users could be surprised when asked for an API key.

Persistence & Privilege

The skill does not request permanent/always-on status, does not modify other skill configurations, and does not persist credentials or change system-wide settings. Auto-invocation is enabled via trigger patterns in SKILL.md (expected for a user-invocable tool), but that is not an elevated privilege on its own.

What to consider before installing

Before installing: (1) note the registry metadata is inaccurate — the skill expects QVERIS_API_KEY in your environment; confirm you are comfortable providing that API key and understand its scope. (2) Verify you trust https://qveris.ai and the author; the script will send requests and any tool execution goes through their service. (3) The README suggests installing 'uv' via curl | sh (astral.sh) — prefer installing tooling from package managers you trust or inspect the install script before running. (4) Run the skill in a contained environment (VM/container) or with a limited-scope API key first. (5) Ask the publisher to fix the registry metadata to declare QVERIS_API_KEY so permission prompts are accurate. If you need higher assurance, review network traffic or have an admin vet the qveris.ai API and the API key's permissions.

QVeris Tool Search & Execution

QVeris provides dynamic tool discovery and execution - search for tools by capability, then execute them with parameters.

Setup

Requires environment variable:

• QVERIS_API_KEY - Get from https://qveris.ai

Quick Start

Search for tools

uv run scripts/qveris_tool.py search "weather forecast API"

Execute a tool

uv run scripts/qveris_tool.py execute openweathermap_current_weather --search-id <id> --params '{"city": "London", "units": "metric"}'

Script Usage

scripts/qveris_tool.py <command> [options]

Commands:
  search <query>     Search for tools matching a capability description
  execute <tool_id>  Execute a specific tool with parameters

Options:
  --limit N          Max results for search (default: 5)
  --search-id ID     Search ID from previous search (required for execute)
  --params JSON      Tool parameters as JSON string
  --max-size N       Max response size in bytes (default: 20480)
  --json             Output raw JSON instead of formatted display

Workflow

1. Search: Describe the capability needed (not specific parameters)

   • Good: "weather forecast API"
   • Bad: "get weather for London"

2. Select: Review tools by success_rate and avg_execution_time

3. Execute: Call tool with tool_id, search_id, and parameters

Example Session

# Find weather tools
uv run scripts/qveris_tool.py search "current weather data"

# Execute with returned tool_id and search_id
uv run scripts/qveris_tool.py execute openweathermap_current_weather \
  --search-id abc123 \
  --params '{"city": "Tokyo", "units": "metric"}'

Use Cases

• Weather Data: Get current weather, forecasts for any location
• Stock Market: Query stock prices, historical data, earnings calendars
• Search: Web search, news retrieval
• Data APIs: Currency exchange, geolocation, translations
• And more: QVeris aggregates thousands of API tools