The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a bash wrapper (scripts/search) to execute its Node.js logic. While it provides instructions for resolving script paths using find and head, these are standard utility commands for finding installed plugins in development environments and do not perform malicious actions.
[CREDENTIALS_UNSAFE]: The skill manages a Valyu API key. It correctly instructs users to provide this key at runtime and securely stores it in the local user's home directory (~/.valyu/config.json). No hardcoded secrets were found; it follows industry best practices for local credential management.
[EXTERNAL_DOWNLOADS]: The skill communicates with api.valyu.ai to perform patent searches. This is the official API endpoint for the service described in the skill metadata. These network operations are necessary for the skill's primary function.
[DATA_EXFILTRATION]: While the skill transmits user search queries and an API key to api.valyu.ai, this behavior is the intended and transparent primary function of the skill (searching a patent database). The destination domain belongs to the service provider, and there is no evidence of sensitive system files being accessed or transmitted.

patents-search