valyu

SUSPICIOUS. The core search/research purpose matches the documented API features, but the skill’s footprint is broader than a simple search reference: it relies on an unverified external CLI, processes large amounts of untrusted web content, supports remote code-execution/MCP options, and can exfiltrate full results to arbitrary webhook endpoints. No confirmed malware is present, but the install trust and data-flow risks are significant enough to rate this as medium-high security risk.