Search YouTube videos, channels, and playlists

PassAudited by ClawScan on May 1, 2026.

Overview

The visible artifacts describe a coherent, instruction-only YouTube search wrapper using AIsa; users should mainly notice that it needs an AIsa API key and sends search queries to an external provider.

This appears reasonable for a YouTube search API skill. Install it only if you trust AIsa, set only the required AISA_API_KEY, avoid sensitive search terms, and consider using a limited or revocable API key.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

The agent can use your AIsa API key to perform searches, which may consume quota or appear in your AIsa account activity.

Why it was flagged

The skill requires a bearer API key to make requests to AIsa. This is expected for the stated API integration, but it gives the agent the ability to use the user's AIsa credential.

Skill content

All requests require the AIsa API key in the Authorization header: Authorization: Bearer $AISA_API_KEY

Recommendation

Use a revocable or quota-limited AIsa key if available, keep it only in the intended environment variable, and rotate or revoke it if you stop using the skill.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Any sensitive terms included in a YouTube search query may be visible to the external API provider.

Why it was flagged

The skill discloses that searches are routed through AIsa rather than directly to YouTube. This provider data flow is purpose-aligned, but user search queries and request metadata are sent to AIsa.

Skill content

All YouTube search requests go through this single endpoint: https://api.aisa.one/apis/v1/youtube/search

Recommendation

Avoid putting secrets or highly private information in search queries, and review AIsa's privacy and retention practices if that matters for your use case.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

You have less independent context for verifying that the package is the intended AIsa YouTube search skill.

Why it was flagged

The registry-level provenance is limited, and the registry version/slug differ from the packaged _meta/SKILL values. Because there is no install script or code payload, this is a provenance note rather than a behavior concern.

Skill content

Source: unknown; Homepage: none

Recommendation

Confirm that api.aisa.one and the marketplace account are the provider you intend to trust before supplying an AIsa API key.