Is chris7iu/qverisai safe?
Use with caution. chris7iu/qverisai is not clearly unsafe, but the audit flagged risks to review before you install it. Oathe's behavioral security audit gave the qverisai skill by chris7iu a trust score of 75/100 with 4 findings (1 critical, 1 high).
https://github.com/openclaw/skills/tree/main/skills/chris7iu/qverisai
Is chris7iu/qverisai safe to install?
This skill acts as a proxy for discovering and executing arbitrary third-party tools through an external API, creating extreme security risk from unknown code execution. While the skill itself appears cleanly implemented, its fundamental design pattern of executing unvetted tools makes it inherently dangerous.
What security issues were found in chris7iu/qverisai?
Category Scores
Findings (4)
CRITICAL Arbitrary Third-Party Tool Execution -80 ▶
The skill's core functionality is to search for and execute arbitrary tools discovered through the QVeris API. This presents extreme security risk as these tools are unvetted, potentially malicious, and executed with the agent's privileges.
HIGH Insecure Design Pattern -70 ▶
The skill acts as a proxy for executing unknown, third-party tools without any security vetting. This creates a massive attack surface where malicious actors could potentially get tools listed in the external API or the API itself could be compromised.
MEDIUM Third-Party Tool Data Access Risk -15 ▶
While the skill itself claims to only access QVERIS_API_KEY, the executed third-party tools could potentially access any data available to the agent, creating indirect exfiltration risk.
LOW Broad Permission Scope -5 ▶
The skill requests broad permissions to 'execute dynamic tools' which could be interpreted liberally by the agent.
Should I install chris7iu/qverisai?
Oathe's verdict for chris7iu/qverisai is CAUTION with a trust score of 75/100. Recommendation: Review before install.