📦

qryma-search

Name: qryma-search
Author: qryma-ai

Revisión del contenido r1 Riesgo alto 🔑 Variables de entorno🌐 Acceso a red📁 Acceso al sistema de archivos⚙️ Comandos externos

Busca en la web con Qryma

Encontrar información web actual puede ser lento cuando un asistente no tiene una ruta de búsqueda. Esta skill envía consultas a Qryma y devuelve resultados estructurados o legibles.

Compatible con: Claude Codex Code(CC)

⚠️ 38 Deficiente

Detente y solicita confirmación antes de instalar.

Revisa el plan y obtén el consentimiento explícito del usuario antes de modificar archivos.

Instalar con mi Agente

Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.

Solicitud de agente

Review the Skillstore skill "qryma-search" from https://skillstore.io/skills/qryma-ai-qryma-search.md and its manifest at https://skillstore.io/api/skills/qryma-ai-qryma-search/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.

Recursos legibles por agentes

Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.

Detalle Markdown GET /skills/qryma-ai-qryma-search.md Manifest firmado GET /api/skills/qryma-ai-qryma-search/manifest Lockfile firmado GET /api/skills/qryma-ai-qryma-search/lockfile

Pruébalo

Usando "qryma-search". Busca guías prácticas para aprender Python.

Resultado esperado:

Una lista numerada en Markdown de resultados de búsqueda con títulos de páginas, enlaces y descripciones concisas.

Usando "qryma-search". Busca debates actuales sobre las API de búsqueda con IA.

Resultado esperado:

Un conjunto compacto de títulos de resultados y URLs que se pueden comparar antes de redactar una nota de investigación.

Usando "qryma-search". Encuentra fuentes sobre configuraciones de búsqueda segura para un flujo de trabajo de búsqueda web.

Resultado esperado:

Un resumen orientado a fuentes que destaca páginas relevantes y el uso probable de cada resultado.

Auditoría de seguridad

Riesgo alto

v7 • 5/7/2026 Abrir el informe versionado

The skill is a legitimate Qryma web-search wrapper, but it performs real network egress and handles API credentials. Confirmed risks include API key loading from environment and .env files, transmission of the key in an outbound header, a configurable endpoint that can redirect credentials, and documentation that encourages sharing keys with an AI assistant.

Archivos escaneados

770

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (9)

Alto

README.md:39

Environment file access

# Method 2: Create .env file

The documentation shows storing QRYMA_API_KEY in shell environment state or a plaintext .env file. This is a common setup method, but it creates a real local secret-exposure risk if history or files are not protected.

Alto

README.md:40

Environment file access

echo 'QRYMA_API_KEY=ak-your-api-key-here' > .env

Alto

scripts/search_core.py:29

Environment file access

env_path = os.path.expanduser("~/.qryma/.env")

The code reads .env or ~/.qryma/.env and extracts QRYMA credentials or endpoint settings. Automatic reads from hidden or local environment files can expose secrets outside the skill package boundary.

Alto

scripts/search_core.py:31

Environment file access

env_path = ".env"

The code reads .env or ~/.qryma/.env and extracts QRYMA credentials or endpoint settings. Automatic reads from hidden or local environment files can expose secrets outside the skill package boundary.

Alto

scripts/search_core.py:55

Environment file access

env_path = os.path.expanduser("~/.qryma/.env")

The code reads .env or ~/.qryma/.env and extracts QRYMA credentials or endpoint settings. Automatic reads from hidden or local environment files can expose secrets outside the skill package boundary.

Alto

scripts/search_core.py:57

Environment file access

env_path = ".env"

The code reads .env or ~/.qryma/.env and extracts QRYMA credentials or endpoint settings. Automatic reads from hidden or local environment files can expose secrets outside the skill package boundary.

Alto

SKILL.md:66

Environment file access

Create `.env` file:

Alto

README.md:20-30 SKILL.md:44-55

API Key Sharing Guidance Risks Secret Disclosure

README.md and SKILL.md tell users to ask an AI assistant to configure QRYMA_API_KEY. If users replace the placeholder with a real key, the secret can be stored in chat logs, tool transcripts, or third-party systems.

The documentation explicitly connects QRYMA_API_KEY setup with asking an AI assistant to configure it. This is a clear social-engineering risk for credential exposure.

Mostrar los 9 problemas confirmados

Alto

scripts/search_core.py:47-71 scripts/search_core.py:112-119

Configurable Endpoint Can Receive API Key

scripts/search_core.py loads QRYMA_ENDPOINT from the environment or .env files, then sends self.api_key in the X-Api-Key header to that endpoint. A modified endpoint can receive both user queries and the API key.

The data flow is visible in the source: endpoint configuration is loaded before the request is built, and the API key is attached to the request headers.

Elementos de revisión de capacidades (35)

Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.

Alto

main_claw.py:35

Generic API/secret keys

adapter = QrymaAdapter(api_key=getattr(args, "api_key", None))

The code accepts an API key through CLI or event parameters and passes it into the adapter/core. Secrets provided this way can appear in process listings, shell history, captured events, or logs.

Alto

main_claw.py:41

Generic API/secret keys

api_key = event.get("api_key") if isinstance(event, dict) else None

The code accepts an API key through CLI or event parameters and passes it into the adapter/core. Secrets provided this way can appear in process listings, shell history, captured events, or logs.

Alto

main_claw.py:42

Generic API/secret keys

adapter = QrymaAdapter(api_key=api_key)

The code accepts an API key through CLI or event parameters and passes it into the adapter/core. Secrets provided this way can appear in process listings, shell history, captured events, or logs.

Alto

README.md:21

Generic API/secret keys

Get your free QRYMA_API_KEY from [qryma.com](https://qryma.com/). Chat with your AI assistant and as

The documentation tells users to provide QRYMA_API_KEY through an AI assistant prompt or similar chat flow. That can disclose a real API key into chat logs, tool transcripts, or third-party model systems.

Alto

README.md:24

Generic API/secret keys

Please configure qryma search with the QRYMA_API_KEY set to ak-your-api-key-here.

Alto

README.md:27

Generic API/secret keys

从[qryma.com](https://qryma.com/) 获取免费的QRYMA_API_KEY,直接发送给你的AI助手,让他帮你自动配置。

Alto

README.md:30

Generic API/secret keys

请帮我配置好qryma search,设置QRYMA_API_KEY为ak-your-api-key-here

Alto

README.md:37

Generic API/secret keys

export QRYMA_API_KEY="ak-your-api-key-here"

Alto

README.md:40

Generic API/secret keys

echo 'QRYMA_API_KEY=ak-your-api-key-here' > .env

Alto

scripts/adapters/adapter.py:28

Generic API/secret keys

adapter = QrymaAdapter(api_key=getattr(args, "api_key", None))

The code accepts an API key through CLI or event parameters and passes it into the adapter/core. Secrets provided this way can appear in process listings, shell history, captured events, or logs.

Alto

scripts/adapters/adapter.py:73

Generic API/secret keys

def __init__(self, core: QrymaSearchCore = None, api_key: str = None):

The code accepts an API key through CLI or event parameters and passes it into the adapter/core. Secrets provided this way can appear in process listings, shell history, captured events, or logs.

Alto

scripts/adapters/adapter.py:77

Generic API/secret keys

self.core = QrymaSearchCore(api_key=api_key)

The code accepts an API key through CLI or event parameters and passes it into the adapter/core. Secrets provided this way can appear in process listings, shell history, captured events, or logs.

Alto

scripts/search_core.py:29

Hidden file in home directory

env_path = os.path.expanduser("~/.qryma/.env")

The code reads .env or ~/.qryma/.env and extracts QRYMA credentials or endpoint settings. Automatic reads from hidden or local environment files can expose secrets outside the skill package boundary.

Alto

scripts/search_core.py:55

Hidden file in home directory

env_path = os.path.expanduser("~/.qryma/.env")

The code reads .env or ~/.qryma/.env and extracts QRYMA credentials or endpoint settings. Automatic reads from hidden or local environment files can expose secrets outside the skill package boundary.

Alto

scripts/search_core.py:29

Hidden file access

env_path = os.path.expanduser("~/.qryma/.env")

The code reads .env or ~/.qryma/.env and extracts QRYMA credentials or endpoint settings. Automatic reads from hidden or local environment files can expose secrets outside the skill package boundary.

Alto

scripts/search_core.py:55

Hidden file access

env_path = os.path.expanduser("~/.qryma/.env")

The code reads .env or ~/.qryma/.env and extracts QRYMA credentials or endpoint settings. Automatic reads from hidden or local environment files can expose secrets outside the skill package boundary.

Alto

scripts/search_core.py:19

Python environment access

key = os.environ.get("QRYMA_API_KEY")

The code reads QRYMA_API_KEY from the process environment for use as a credential. This is expected for the skill, but it is still real environment-secret access.

Alto

scripts/search_core.py:19

Generic API/secret keys

key = os.environ.get("QRYMA_API_KEY")

The code reads QRYMA_API_KEY from the process environment for use as a credential. This is expected for the skill, but it is still real environment-secret access.

Alto

scripts/search_core.py:36

Generic API/secret keys

m = re.search(r"^\s*QRYMA_API_KEY\s*=\s*(.+?)\s*$", txt, re.M)

The code reads .env or ~/.qryma/.env and extracts QRYMA credentials or endpoint settings. Automatic reads from hidden or local environment files can expose secrets outside the skill package boundary.

Alto

scripts/search_core.py:77

Generic API/secret keys

def __init__(self, api_key: Optional[str] = None, endpoint: Optional[str] = None):

The code accepts an API key through CLI or event parameters and passes it into the adapter/core. Secrets provided this way can appear in process listings, shell history, captured events, or logs.

Alto

scripts/search_core.py:78

Generic API/secret keys

self.api_key = api_key or load_key()

The code accepts an API key through CLI or event parameters and passes it into the adapter/core. Secrets provided this way can appear in process listings, shell history, captured events, or logs.

Alto

scripts/search_core.py:119

Generic API/secret keys

"X-Api-Key": self.api_key,

The code places self.api_key into the X-Api-Key header on the outbound request. This transmits a secret externally and becomes an exfiltration path if the endpoint is redirected.

Alto

SKILL.md:46

Generic API/secret keys

Get your free QRYMA_API_KEY from [qryma.com](https://qryma.com/). Chat with your AI assistant and as

Alto

SKILL.md:49

Generic API/secret keys

Please configure qryma search with the QRYMA_API_KEY set to ak-your-api-key-here.

Alto

SKILL.md:52

Generic API/secret keys

从 [qryma.com](https://qryma.com/) 获取免费的 QRYMA_API_KEY,直接发送给你的 AI 助手,让他帮你自动配置。

Alto

SKILL.md:55

Generic API/secret keys

请帮我配置好 qryma search,设置 QRYMA_API_KEY 为 ak-your-api-key-here

Alto

SKILL.md:62

Generic API/secret keys

export QRYMA_API_KEY="ak-your-api-key-here"

Alto

SKILL.md:68

Generic API/secret keys

QRYMA_API_KEY=ak-your-api-key-here

Medio

scripts/search_core.py:50

Python environment access

endpoint = os.environ.get("QRYMA_ENDPOINT")

QRYMA_ENDPOINT from the environment controls the destination used for the later request. If this setting is changed unexpectedly, the API key and queries can be sent to an untrusted service.

Bajo

manifest.json:107

Hardcoded URL

"default": "https://search.qryma.com/api/web"

The skill performs outbound HTTP requests to the Qryma search API and sends user search queries off-device. Network egress is expected for search, but it is a real data-transfer behavior users must understand.

Bajo

scripts/search_core.py:9

Python HTTP libraries

import urllib.request

Bajo

scripts/search_core.py:112

Python HTTP libraries

req = urllib.request.Request(

Bajo

scripts/search_core.py:123

Python HTTP libraries

with urllib.request.urlopen(req, timeout=30) as resp:

Bajo

scripts/search_core.py:14

Hardcoded URL

QRYMA_URL = "https://search.qryma.com/api/web"

Bajo

scripts/search_core.py:71

Hardcoded URL

return "https://search.qryma.com/api/web"

Factores de riesgo

🔑 Variables de entorno (32)

🌐 Acceso a red (17)

manifest.json:7 manifest.json:57 manifest.json:107 package.json:22 package.json:24 README.md:12 README.md:15 scripts/search_core.py:9 scripts/search_core.py:112 scripts/search_core.py:123 scripts/search_core.py:14 scripts/search_core.py:71 scripts/search_core.py:118 SKILL.md:12 SKILL.md:38 SKILL.md:46 SKILL.md:52

📁 Acceso al sistema de archivos (4)

scripts/search_core.py:29 scripts/search_core.py:55 scripts/search_core.py:29 scripts/search_core.py:55

⚙️ Comandos externos (14)

SKILL.md:17-19 SKILL.md:19-22 SKILL.md:22-24 SKILL.md:24-27 SKILL.md:27-29 SKILL.md:29-48 SKILL.md:48-50 SKILL.md:50-54 SKILL.md:54-56 SKILL.md:56-61 SKILL.md:61-63 SKILL.md:63-66 SKILL.md:66-67 SKILL.md:67-69

Auditado por: codex Ver historial de auditorías →

Compartir y citar este informe

Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.

Abrir el informe versionado

Copiar enlace del informe

https://skillstore.io/skills/qryma-ai-qryma-search/audits/7?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Insignia Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/qryma-ai-qryma-search/security.svg)](https://skillstore.io/skills/qryma-ai-qryma-search?utm_source=security_passport_badge)

Insignia HTML

<a href="https://skillstore.io/skills/qryma-ai-qryma-search?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/qryma-ai-qryma-search/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Tarjeta para insertar

<iframe src="https://skillstore.io/embed/skills/qryma-ai-qryma-search.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citas académicas (APA · BibTeX · CFF)

Cita APA

qryma-ai. (2026). qryma-search security audit report (audit version 7) [Author version unspecified]. Skillstore. https://skillstore.io/skills/qryma-ai-qryma-search/audits/7

Cita BibTeX

@techreport{qryma-ai-qryma-ai-qryma-search-2026,
  author = {qryma-ai},
  title = {qryma-search security audit report (audit version 7)},
  institution = {Skillstore},
  year = {2026},
  number = {7},
  url = {https://skillstore.io/skills/qryma-ai-qryma-search/audits/7},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "qryma-search security audit report (audit version 7)"
version: "unspecified"
type: report
authors:
  - name: "qryma-ai"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/qryma-ai-qryma-search/audits/7"
identifiers:
  - type: other
    value: "skillstore:qryma-ai-qryma-search:audit:7"
    description: "Skillstore immutable audit report identifier"

Puntuación de Skillstore

Por qué esta puntuación Confianza de la evidencia: Medio

Arquitectura

Mantenibilidad

Contenido

Comunidad

Cumplimiento de la especificación

Lo que puedes crear

Recopilar enlaces de fuentes

Encuentra páginas web relevantes para un tema y devuelve resultados concisos en Markdown para su revisión.

Añadir búsqueda a flujos de trabajo de agentes

Da a un asistente un comando repetible para búsquedas web con formatos de resultados configurables.

Comprobar señales de mercado o producto

Busca páginas recientes sobre competidores, productos o tendencias antes de redactar un resumen.

Prueba estos prompts

Buscar un tema

Usa qryma-search para buscar {topic}. Devuelve cinco resultados en Markdown con títulos, enlaces y fragmentos breves.

Encontrar contexto reciente

Busca en la web información reciente sobre {subject}. Resume los resultados más relevantes e incluye enlaces a las fuentes.

Comparar fuentes

Busca {question} con hasta diez resultados. Agrupa los resultados por punto de vista, tipo de fuente y utilidad.

Ejecutar investigación filtrada

Busca {query} usando el idioma {language}, el modo {fulltext_or_snippet}, la búsqueda segura {on_or_off} y {max_results} resultados. Devuelve los hallazgos en el formato que solicite.

Mejores prácticas

Usa un almacén de secretos administrado o una variable de entorno protegida para QRYMA_API_KEY.
Haz preguntas de búsqueda enfocadas y solicita enlaces a fuentes para revisarlos más tarde.
Usa la salida en Markdown para lectura y la salida estructurada para procesamiento posterior.

Evitar

No pegues claves de API reales en prompts de chat ni en transcripciones compartidas.
No uses esta skill para consultas privadas o reguladas sin revisar el manejo de datos de Qryma.
No confíes en los fragmentos de búsqueda como hechos verificados sin comprobar las fuentes enlazadas.