One API key for 70+ AI models. Route to GPT, Claude, Gemini, Qwen, Deepseek, Grok and more

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 10:40 AM UTC
• Version: 1.0.0

Overview

This is a straightforward LLM gateway helper that sends user-provided prompts and image references to AIsa, with no hidden persistence or unrelated local data access found.

Install only if you are comfortable sending selected prompts, conversation history, image URLs or base64 image data, and tool schemas to AIsa and possibly downstream model providers. Avoid secrets, regulated data, private screenshots, or proprietary schemas unless you have approved that data path and understand billing for the selected models.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (21)

External Model or Provider Selection

High

• Category: Excessive Agency

Content

formatter_class=argparse.RawDescriptionHelpFormatter,
        epilog="""
Examples:
    %(prog)s chat --model gpt-4.1 --message "Hello!"
    %(prog)s chat --model claude-3-sonnet --message "Write a poem" --stream
    %(prog)s chat --model gpt-4 --system "You are a pirate" --message "Greet me"
    %(prog)s vision --model gpt-4o --image "https://example.com/img.jpg" --prompt "Describe this"

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

epilog="""
Examples:
    %(prog)s chat --model gpt-4.1 --message "Hello!"
    %(prog)s chat --model claude-3-sonnet --message "Write a poem" --stream
    %(prog)s chat --model gpt-4 --system "You are a pirate" --message "Greet me"
    %(prog)s vision --model gpt-4o --image "https://example.com/img.jpg" --prompt "Describe this"
    %(prog)s compare --models "gpt-4.1,claude-3-sonnet" --message "Explain AI"

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

Examples:
    %(prog)s chat --model gpt-4.1 --message "Hello!"
    %(prog)s chat --model claude-3-sonnet --message "Write a poem" --stream
    %(prog)s chat --model gpt-4 --system "You are a pirate" --message "Greet me"
    %(prog)s vision --model gpt-4o --image "https://example.com/img.jpg" --prompt "Describe this"
    %(prog)s compare --models "gpt-4.1,claude-3-sonnet" --message "Explain AI"
    %(prog)s models

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

%(prog)s chat --model gpt-4.1 --message "Hello!"
    %(prog)s chat --model claude-3-sonnet --message "Write a poem" --stream
    %(prog)s chat --model gpt-4 --system "You are a pirate" --message "Greet me"
    %(prog)s vision --model gpt-4o --image "https://example.com/img.jpg" --prompt "Describe this"
    %(prog)s compare --models "gpt-4.1,claude-3-sonnet" --message "Explain AI"
    %(prog)s models
        """

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README explicitly demonstrates sending user prompts and remote image URLs to a third-party gateway service, but it does not disclose privacy, logging, retention, or downstream provider-sharing implications. In an agent skill context, this omission can cause operators to unknowingly transmit sensitive prompts, images, or embedded secrets to an external multi-provider service.

External Transmission

Medium

• Category: Data Exfiltration

Content

client = OpenAI(
    api_key=os.environ["AISA_API_KEY"],
    base_url="https://api.aisa.one/v1"
)

response = client.chat.completions.create(

• Confidence: 88% confidence
• Finding: The code sample configures the OpenAI SDK to use a non-OpenAI base_url, causing all model inputs and outputs to be transmitted to api.aisa.one. While external transmission is expected for an LLM router, the README does not contextualize trust boundaries, provider routing, or sensitive-data risks, which makes this a real security concern for users who may assume OpenAI-compatible code implies standard OpenAI handling.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill explicitly requires an API key and demonstrates outbound network access, but it does not declare any tool/permission scope to constrain those capabilities. In an agent ecosystem, this weakens reviewability and increases the chance that a caller grants broader execution/network access than intended, enabling unvetted exfiltration of prompts, files, or secrets.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This section instructs users to send prompts and potentially image content to a third-party endpoint without any privacy or data-handling warning. Because the skill is a routing gateway to many downstream models/providers, users may unknowingly transmit sensitive text, images, or embedded metadata outside their trust boundary.

External Transmission

Medium

• Category: Data Exfiltration

Content

#### Request

```bash
curl -X POST "https://api.aisa.one/v1/chat/completions" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 91% confidence
• Finding: This duplicated finding points to the same authenticated POST example that exports prompt content to api.aisa.one. In context, the skill is designed for third-party inference routing, so the transmission is intentional but still a material data-exposure risk if users send sensitive information.

External Transmission

Medium

• Category: Data Exfiltration

Content

#### Request

```bash
curl -X POST "https://api.aisa.one/v1/chat/completions" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 91% confidence
• Finding: This duplicated finding points to the same authenticated POST example that exports prompt content to api.aisa.one. In context, the skill is designed for third-party inference routing, so the transmission is intentional but still a material data-exposure risk if users send sensitive information.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Streaming Response

```bash
curl -X POST "https://api.aisa.one/v1/chat/completions" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 89% confidence
• Finding: This duplicated finding refers to the streaming POST example that transmits prompts externally. The context makes the behavior expected, but not harmless: users may assume local processing unless clearly warned otherwise.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Streaming Response

```bash
curl -X POST "https://api.aisa.one/v1/chat/completions" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 89% confidence
• Finding: This duplicated finding refers to the streaming POST example that transmits prompts externally. The context makes the behavior expected, but not harmless: users may assume local processing unless clearly warned otherwise.

External Transmission

Medium

• Category: Data Exfiltration

Content

Analyze images by passing image URLs or base64 data:

```bash
curl -X POST "https://api.aisa.one/v1/chat/completions" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 96% confidence
• Finding: The vision example sends image URLs or base64 image data to a third-party API, which can expose sensitive visual content, embedded metadata, internal document screenshots, or private URLs. Compared with text-only prompts, image submission broadens the risk because screenshots often contain credentials, PII, proprietary diagrams, or hidden EXIF/location data.

External Transmission

Medium

• Category: Data Exfiltration

Content

Enable tools/functions for structured outputs:

```bash
curl -X POST "https://api.aisa.one/v1/chat/completions" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 83% confidence
• Finding: The function-calling example sends prompts and tool schemas to an external service. While the schema itself is not necessarily sensitive, it can reveal internal tool names, capabilities, and business logic, and the prompt content is still transmitted outside the local trust boundary.

External Transmission

Medium

• Category: Data Exfiltration

Content

```

```bash
curl -X POST "https://api.aisa.one/v1/models/gemini-2.0-flash:generateContent" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 90% confidence
• Finding: This example sends Gemini-format content to the external AIsa API, again exporting prompt data beyond the local system. Because this format is provider-specific, users may also incorrectly assume data goes only to AIsa when it may be routed onward within the gateway model ecosystem.

External Transmission

Medium

• Category: Data Exfiltration

Content

client = OpenAI(
    api_key=os.environ["AISA_API_KEY"],
    base_url="https://api.aisa.one/v1"
)

response = client.chat.completions.create(

• Confidence: 82% confidence
• Finding: The OpenAI SDK compatibility example configures a third-party base URL, causing downstream application prompts and responses to be redirected to AIsa instead of the original provider. This can materially change the data-processing boundary and may surprise developers who think they are only switching SDK plumbing.

External Transmission

Medium

• Category: Data Exfiltration

Content

class LLMRouterClient:
    """Unified LLM Gateway Client for AIsa API."""
    
    BASE_URL = "https://api.aisa.one/v1"
    
    # Popular models for reference (check marketplace.aisa.one/pricing for full list)
    SUPPORTED_MODELS = {

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

class LLMRouterClient:
    """Unified LLM Gateway Client for AIsa API."""
    
    BASE_URL = "https://api.aisa.one/v1"
    
    # Popular models for reference (check marketplace.aisa.one/pricing for full list)
    SUPPORTED_MODELS = {

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

class LLMRouterClient:
    """Unified LLM Gateway Client for AIsa API."""
    
    BASE_URL = "https://api.aisa.one/v1"
    
    # Popular models for reference (check marketplace.aisa.one/pricing for full list)
    SUPPORTED_MODELS = {

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The client sends prompts, system messages, full message histories, and vision image URLs to a third-party API, but the CLI provides no explicit warning, confirmation, or privacy notice before transmitting potentially sensitive data off-host. In a skill context, users may assume a local helper script, making silent external transmission more dangerous because secrets, proprietary text, or internal image URLs can be unintentionally disclosed.

Missing User Warnings

Low

• Confidence: 79% confidence
• Finding: The documentation tells users to export an API key but gives no guidance on secure credential handling. That omission can lead to unsafe practices such as hardcoding keys, pasting them into shared shells, logs, or source control, which increases the risk of credential theft and unauthorized billing.

Static analysis

No suspicious patterns detected.