스킬 qryma-search
📦
qryma-search
콘텐츠 리비전 r1 높은 위험 🔑 환경 변수🌐 네트워크 접근📁 파일 시스템 접근⚙️ 외부 명령어
Qryma로 웹 검색하기
어시스턴트에 검색 경로가 없으면 최신 웹 정보를 찾는 데 시간이 오래 걸릴 수 있습니다. 이 스킬은 Qryma에 쿼리를 보내고 구조화되었거나 읽기 쉬운 결과를 반환합니다.
지원: Claude Codex Code(CC)
설치 전에 중지하고 확인을 요청하세요.
계획을 검토하고 파일을 변경하기 전에 사용자의 명시적 동의를 받으세요.
내 에이전트로 설치
이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.
에이전트 요청
Review the Skillstore skill "qryma-search" from https://skillstore.io/skills/qryma-ai-qryma-search.md and its manifest at https://skillstore.io/api/skills/qryma-ai-qryma-search/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.
에이전트가 읽기 쉬운 리소스
AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.
테스트해 보기
"qryma-search" 사용 중입니다. Search for practical guides to learning Python.
예상 결과:
페이지 제목, 링크, 간결한 설명이 포함된 번호 매기기 Markdown 검색 결과 목록입니다.
"qryma-search" 사용 중입니다. Look up current discussion about AI search APIs.
예상 결과:
리서치 노트를 작성하기 전에 비교할 수 있는 간결한 결과 제목 및 URL 모음입니다.
"qryma-search" 사용 중입니다. Find sources about safe search settings for a web lookup workflow.
예상 결과:
관련 페이지와 각 결과의 예상 용도를 강조하는 소스 중심 요약입니다.
보안 감사
높은 위험v7 • 2026. 7. 5. 버전별 보고서 열기
The skill is a legitimate Qryma web-search wrapper, but it performs real network egress and handles API credentials. Confirmed risks include API key loading from environment and .env files, transmission of the key in an outbound header, a configurable endpoint that can redirect credentials, and documentation that encourages sharing keys with an AI assistant.
12
스캔된 파일
770
분석된 줄 수
35
검토 항목
0
오탐 무시됨
확인된 보안 우려 사항 (9)
높음
Environment file access
# Method 2: Create .env file
The documentation shows storing QRYMA_API_KEY in shell environment state or a plaintext .env file. This is a common setup method, but it creates a real local secret-exposure risk if history or files are not protected.
높음
Environment file access
echo 'QRYMA_API_KEY=ak-your-api-key-here' > .env
The documentation shows storing QRYMA_API_KEY in shell environment state or a plaintext .env file. This is a common setup method, but it creates a real local secret-exposure risk if history or files are not protected.
높음
Environment file access
env_path = os.path.expanduser("~/.qryma/.env")
The code reads .env or ~/.qryma/.env and extracts QRYMA credentials or endpoint settings. Automatic reads from hidden or local environment files can expose secrets outside the skill package boundary.
높음
Environment file access
env_path = ".env"
The code reads .env or ~/.qryma/.env and extracts QRYMA credentials or endpoint settings. Automatic reads from hidden or local environment files can expose secrets outside the skill package boundary.
높음
Environment file access
env_path = os.path.expanduser("~/.qryma/.env")
The code reads .env or ~/.qryma/.env and extracts QRYMA credentials or endpoint settings. Automatic reads from hidden or local environment files can expose secrets outside the skill package boundary.
높음
Environment file access
env_path = ".env"
The code reads .env or ~/.qryma/.env and extracts QRYMA credentials or endpoint settings. Automatic reads from hidden or local environment files can expose secrets outside the skill package boundary.
높음
Environment file access
Create `.env` file:
The documentation shows storing QRYMA_API_KEY in shell environment state or a plaintext .env file. This is a common setup method, but it creates a real local secret-exposure risk if history or files are not protected.
높음
API Key Sharing Guidance Risks Secret Disclosure
README.md and SKILL.md tell users to ask an AI assistant to configure QRYMA_API_KEY. If users replace the placeholder with a real key, the secret can be stored in chat logs, tool transcripts, or third-party systems.
The documentation explicitly connects QRYMA_API_KEY setup with asking an AI assistant to configure it. This is a clear social-engineering risk for credential exposure.
확인된 9건 모두 보기
높음
Configurable Endpoint Can Receive API Key
scripts/search_core.py loads QRYMA_ENDPOINT from the environment or .env files, then sends self.api_key in the X-Api-Key header to that endpoint. A modified endpoint can receive both user queries and the API key.
The data flow is visible in the source: endpoint configuration is loaded before the request is built, and the API key is attached to the request headers.
기능 검토 항목 (35)
이 스킬에 대해 예상될 수 있는 실제 로컬 기능이므로 검토가 필요하지만, 확인된 악의적 동작으로는 집계되지 않습니다.
높음
Generic API/secret keys
adapter = QrymaAdapter(api_key=getattr(args, "api_key", None))
The code accepts an API key through CLI or event parameters and passes it into the adapter/core. Secrets provided this way can appear in process listings, shell history, captured events, or logs.
높음
Generic API/secret keys
api_key = event.get("api_key") if isinstance(event, dict) else None
The code accepts an API key through CLI or event parameters and passes it into the adapter/core. Secrets provided this way can appear in process listings, shell history, captured events, or logs.
높음
Generic API/secret keys
adapter = QrymaAdapter(api_key=api_key)
The code accepts an API key through CLI or event parameters and passes it into the adapter/core. Secrets provided this way can appear in process listings, shell history, captured events, or logs.
높음
Generic API/secret keys
Get your free QRYMA_API_KEY from [qryma.com](https://qryma.com/). Chat with your AI assistant and as
The documentation tells users to provide QRYMA_API_KEY through an AI assistant prompt or similar chat flow. That can disclose a real API key into chat logs, tool transcripts, or third-party model systems.
높음
Generic API/secret keys
Please configure qryma search with the QRYMA_API_KEY set to ak-your-api-key-here.
The documentation tells users to provide QRYMA_API_KEY through an AI assistant prompt or similar chat flow. That can disclose a real API key into chat logs, tool transcripts, or third-party model systems.
높음
Generic API/secret keys
从[qryma.com](https://qryma.com/) 获取免费的QRYMA_API_KEY,直接发送给你的AI助手,让他帮你自动配置。
The documentation tells users to provide QRYMA_API_KEY through an AI assistant prompt or similar chat flow. That can disclose a real API key into chat logs, tool transcripts, or third-party model systems.
높음
Generic API/secret keys
请帮我配置好qryma search,设置QRYMA_API_KEY为ak-your-api-key-here
The documentation tells users to provide QRYMA_API_KEY through an AI assistant prompt or similar chat flow. That can disclose a real API key into chat logs, tool transcripts, or third-party model systems.
높음
Generic API/secret keys
export QRYMA_API_KEY="ak-your-api-key-here"
The documentation shows storing QRYMA_API_KEY in shell environment state or a plaintext .env file. This is a common setup method, but it creates a real local secret-exposure risk if history or files are not protected.
높음
Generic API/secret keys
echo 'QRYMA_API_KEY=ak-your-api-key-here' > .env
The documentation shows storing QRYMA_API_KEY in shell environment state or a plaintext .env file. This is a common setup method, but it creates a real local secret-exposure risk if history or files are not protected.
높음
Generic API/secret keys
adapter = QrymaAdapter(api_key=getattr(args, "api_key", None))
The code accepts an API key through CLI or event parameters and passes it into the adapter/core. Secrets provided this way can appear in process listings, shell history, captured events, or logs.
높음
Generic API/secret keys
def __init__(self, core: QrymaSearchCore = None, api_key: str = None):
The code accepts an API key through CLI or event parameters and passes it into the adapter/core. Secrets provided this way can appear in process listings, shell history, captured events, or logs.
높음
Generic API/secret keys
self.core = QrymaSearchCore(api_key=api_key)
The code accepts an API key through CLI or event parameters and passes it into the adapter/core. Secrets provided this way can appear in process listings, shell history, captured events, or logs.
높음
Hidden file in home directory
env_path = os.path.expanduser("~/.qryma/.env")
The code reads .env or ~/.qryma/.env and extracts QRYMA credentials or endpoint settings. Automatic reads from hidden or local environment files can expose secrets outside the skill package boundary.
높음
Hidden file in home directory
env_path = os.path.expanduser("~/.qryma/.env")
The code reads .env or ~/.qryma/.env and extracts QRYMA credentials or endpoint settings. Automatic reads from hidden or local environment files can expose secrets outside the skill package boundary.
높음
Hidden file access
env_path = os.path.expanduser("~/.qryma/.env")
The code reads .env or ~/.qryma/.env and extracts QRYMA credentials or endpoint settings. Automatic reads from hidden or local environment files can expose secrets outside the skill package boundary.
높음
Hidden file access
env_path = os.path.expanduser("~/.qryma/.env")
The code reads .env or ~/.qryma/.env and extracts QRYMA credentials or endpoint settings. Automatic reads from hidden or local environment files can expose secrets outside the skill package boundary.
높음
Python environment access
key = os.environ.get("QRYMA_API_KEY")
The code reads QRYMA_API_KEY from the process environment for use as a credential. This is expected for the skill, but it is still real environment-secret access.
높음
Generic API/secret keys
key = os.environ.get("QRYMA_API_KEY")
The code reads QRYMA_API_KEY from the process environment for use as a credential. This is expected for the skill, but it is still real environment-secret access.
높음
Generic API/secret keys
m = re.search(r"^\s*QRYMA_API_KEY\s*=\s*(.+?)\s*$", txt, re.M)
The code reads .env or ~/.qryma/.env and extracts QRYMA credentials or endpoint settings. Automatic reads from hidden or local environment files can expose secrets outside the skill package boundary.
높음
Generic API/secret keys
def __init__(self, api_key: Optional[str] = None, endpoint: Optional[str] = None):
The code accepts an API key through CLI or event parameters and passes it into the adapter/core. Secrets provided this way can appear in process listings, shell history, captured events, or logs.
높음
Generic API/secret keys
self.api_key = api_key or load_key()
The code accepts an API key through CLI or event parameters and passes it into the adapter/core. Secrets provided this way can appear in process listings, shell history, captured events, or logs.
높음
Generic API/secret keys
"X-Api-Key": self.api_key,
The code places self.api_key into the X-Api-Key header on the outbound request. This transmits a secret externally and becomes an exfiltration path if the endpoint is redirected.
높음
Generic API/secret keys
Get your free QRYMA_API_KEY from [qryma.com](https://qryma.com/). Chat with your AI assistant and as
The documentation tells users to provide QRYMA_API_KEY through an AI assistant prompt or similar chat flow. That can disclose a real API key into chat logs, tool transcripts, or third-party model systems.
높음
Generic API/secret keys
Please configure qryma search with the QRYMA_API_KEY set to ak-your-api-key-here.
The documentation tells users to provide QRYMA_API_KEY through an AI assistant prompt or similar chat flow. That can disclose a real API key into chat logs, tool transcripts, or third-party model systems.
높음
Generic API/secret keys
从 [qryma.com](https://qryma.com/) 获取免费的 QRYMA_API_KEY,直接发送给你的 AI 助手,让他帮你自动配置。
The documentation tells users to provide QRYMA_API_KEY through an AI assistant prompt or similar chat flow. That can disclose a real API key into chat logs, tool transcripts, or third-party model systems.
높음
Generic API/secret keys
请帮我配置好 qryma search,设置 QRYMA_API_KEY 为 ak-your-api-key-here
The documentation tells users to provide QRYMA_API_KEY through an AI assistant prompt or similar chat flow. That can disclose a real API key into chat logs, tool transcripts, or third-party model systems.
높음
Generic API/secret keys
export QRYMA_API_KEY="ak-your-api-key-here"
The documentation shows storing QRYMA_API_KEY in shell environment state or a plaintext .env file. This is a common setup method, but it creates a real local secret-exposure risk if history or files are not protected.
높음
Generic API/secret keys
QRYMA_API_KEY=ak-your-api-key-here
The documentation shows storing QRYMA_API_KEY in shell environment state or a plaintext .env file. This is a common setup method, but it creates a real local secret-exposure risk if history or files are not protected.
중간
Python environment access
endpoint = os.environ.get("QRYMA_ENDPOINT")
QRYMA_ENDPOINT from the environment controls the destination used for the later request. If this setting is changed unexpectedly, the API key and queries can be sent to an untrusted service.
낮음
Hardcoded URL
"default": "https://search.qryma.com/api/web"
The skill performs outbound HTTP requests to the Qryma search API and sends user search queries off-device. Network egress is expected for search, but it is a real data-transfer behavior users must understand.
낮음
Python HTTP libraries
import urllib.request
The skill performs outbound HTTP requests to the Qryma search API and sends user search queries off-device. Network egress is expected for search, but it is a real data-transfer behavior users must understand.
낮음
Python HTTP libraries
req = urllib.request.Request(
The skill performs outbound HTTP requests to the Qryma search API and sends user search queries off-device. Network egress is expected for search, but it is a real data-transfer behavior users must understand.
낮음
Python HTTP libraries
with urllib.request.urlopen(req, timeout=30) as resp:
The skill performs outbound HTTP requests to the Qryma search API and sends user search queries off-device. Network egress is expected for search, but it is a real data-transfer behavior users must understand.
낮음
Hardcoded URL
QRYMA_URL = "https://search.qryma.com/api/web"
The skill performs outbound HTTP requests to the Qryma search API and sends user search queries off-device. Network egress is expected for search, but it is a real data-transfer behavior users must understand.
낮음
Hardcoded URL
return "https://search.qryma.com/api/web"
The skill performs outbound HTTP requests to the Qryma search API and sends user search queries off-device. Network egress is expected for search, but it is a real data-transfer behavior users must understand.
위험 요인
🔑 환경 변수 (32)
main_claw.py:35 main_claw.py:41 main_claw.py:42 manifest.json:99 README.md:21 README.md:24 README.md:27 README.md:30 README.md:37 README.md:40 requirements.txt:2 scripts/adapters/adapter.py:28 scripts/adapters/adapter.py:73 scripts/adapters/adapter.py:77 scripts/search_core.py:19 scripts/search_core.py:24 scripts/search_core.py:50 scripts/search_core.py:19 scripts/search_core.py:36 scripts/search_core.py:77 scripts/search_core.py:78 scripts/search_core.py:91 scripts/search_core.py:92 scripts/search_core.py:119 skill.json:6 skill.json:7 SKILL.md:46 SKILL.md:49 SKILL.md:52 SKILL.md:55 SKILL.md:62 SKILL.md:68
🌐 네트워크 접근 (17)
manifest.json:7 manifest.json:57 manifest.json:107 package.json:22 package.json:24 README.md:12 README.md:15 scripts/search_core.py:9 scripts/search_core.py:112 scripts/search_core.py:123 scripts/search_core.py:14 scripts/search_core.py:71 scripts/search_core.py:118 SKILL.md:12 SKILL.md:38 SKILL.md:46 SKILL.md:52
📁 파일 시스템 접근 (4)
감사자: codex 감사 이력 보기 →
이 보고서 공유 및 인용
버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.
보고서 링크 복사
https://skillstore.io/skills/qryma-ai-qryma-search/audits/7?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 배지
[](https://skillstore.io/skills/qryma-ai-qryma-search?utm_source=security_passport_badge)HTML 배지
<a href="https://skillstore.io/skills/qryma-ai-qryma-search?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/qryma-ai-qryma-search/security.svg" alt="Skillstore security assessment" loading="lazy"></a>임베드 카드
<iframe src="https://skillstore.io/embed/skills/qryma-ai-qryma-search.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>학술 인용 (APA · BibTeX · CFF)
APA 인용
qryma-ai. (2026). qryma-search security audit report (audit version 7) [Author version unspecified]. Skillstore. https://skillstore.io/skills/qryma-ai-qryma-search/audits/7BibTeX 인용
@techreport{qryma-ai-qryma-ai-qryma-search-2026,
author = {qryma-ai},
title = {qryma-search security audit report (audit version 7)},
institution = {Skillstore},
year = {2026},
number = {7},
url = {https://skillstore.io/skills/qryma-ai-qryma-search/audits/7},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "qryma-search security audit report (audit version 7)"
version: "unspecified"
type: report
authors:
- name: "qryma-ai"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/qryma-ai-qryma-search/audits/7"
identifiers:
- type: other
value: "skillstore:qryma-ai-qryma-search:audit:7"
description: "Skillstore immutable audit report identifier"
Skillstore 점수
이 점수의 이유 증거 신뢰도: 중간 59
아키텍처
85
유지보수성
87
콘텐츠
68
커뮤니티
83
사양 준수
만들 수 있는 것
소스 링크 수집
주제와 관련된 웹 페이지를 찾고 검토할 수 있도록 간결한 Markdown 결과를 반환합니다.
에이전트 워크플로에 검색 추가
구성 가능한 결과 형식으로 웹 조회를 수행할 수 있는 반복 가능한 명령을 어시스턴트에 제공합니다.
시장 또는 제품 신호 확인
요약을 작성하기 전에 경쟁사, 제품 또는 트렌드에 관한 최신 페이지를 검색합니다.
이 프롬프트를 사용해 보세요
주제 검색
Use qryma-search to search for {topic}. Return five Markdown results with titles, links, and short snippets.최신 맥락 찾기
Search the web for recent information about {subject}. Summarize the most relevant results and include source links.소스 비교
Search for {question} with up to ten results. Group the results by viewpoint, source type, and usefulness.필터링된 리서치 실행
Search for {query} using language {language}, mode {fulltext_or_snippet}, safe search {on_or_off}, and {max_results} results. Return the findings in the format I request.모범 사례
- QRYMA_API_KEY에는 관리형 비밀 저장소나 보호된 환경 변수를 사용하세요.
- 집중된 검색 질문을 하고 나중에 검토할 수 있도록 소스 링크를 요청하세요.
- 읽기에는 Markdown 출력을, 다운스트림 처리에는 구조화 출력을 사용하세요.
피하기
- 실제 API 키를 채팅 프롬프트나 공유된 대화 기록에 붙여넣지 마세요.
- Qryma 데이터 처리 방식을 검토하지 않고 비공개 또는 규제 대상 쿼리에 이 스킬을 사용하지 마세요.
- 연결된 소스를 확인하지 않고 검색 스니펫을 검증된 사실로 신뢰하지 마세요.
자주 묻는 질문
이 스킬에는 API 키가 필요한가요?
예. Qryma Search API를 호출하려면 QRYMA_API_KEY가 필요합니다.
어떤 출력 형식이 지원되나요?
Markdown, 원시 구조화 출력, Brave 스타일 결과 형식을 지원합니다.
검색 언어를 변경할 수 있나요?
예. 검색을 실행할 때 언어 옵션을 설정할 수 있습니다.
완전히 오프라인으로 실행되나요?
아니요. Qryma 검색 엔드포인트로 요청을 보냅니다.
사용자 지정 엔드포인트를 사용할 수 있나요?
코드는 QRYMA_ENDPOINT를 지원하지만, 사용자 지정 엔드포인트는 API 키를 받을 수 있습니다.
API 키를 어시스턴트 채팅에 붙여넣어도 되나요?
아니요. 보호된 비밀 저장소나 로컬 환경 설정을 통해 키를 구성하세요.