Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- index.ts:29
- Evidence
const key = config.aisaApiKey || process.env.AISA_API_KEY || "";
Security audit
AIsa Multi Search Engine
Security checks for vulnerabilities and agentic risk
Overview
This looks like a legitimate AIsa-backed search plugin, with the main caveat that the registry summary underreports its API-key requirement and code-based runtime.
Before installing, be comfortable that your search queries, URLs you ask it to extract, and results used for synthesis will be sent to api.aisa.one and may use downstream services such as Tavily or Perplexity through AIsa. You will need to provide an AIsa API key even though the registry requirements summary says none. Because the provided source view for the main code files is truncated, review the full index.ts and scripts/search_client.py from the repository if you need higher assurance.
Static analysis
Detected: suspicious.env_credential_access