aisa financial data api

• Outcome: Pass
• Latest audit: May 28, 2026 at 6:19 AM UTC
• Version:
  1.0.0

Overview

This skill is a disclosed financial-data client that sends market queries and an AISA API key to the documented AIsa API, with no evidence of hidden or destructive behavior.

Install only if you trust AIsa with your API key and the market queries you submit. Use a dedicated API key where possible, monitor usage or costs, and avoid sending proprietary investment screens, portfolio details, or sensitive research criteria unless that is acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares required environment variables and demonstrates extensive outbound network access, but the file does not declare explicit permissions for those capabilities. This creates a governance and consent gap: a host system or reviewer may underestimate what the skill can access and transmit, including API-backed requests made with sensitive credentials.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The skill repeatedly instructs the agent to send user-supplied financial queries to a third-party API using an API key, but it does not prominently warn that prompts, tickers, screening criteria, and potentially sensitive portfolio interests will leave the local environment. While this is not exploit code, the missing disclosure can cause unintended data sharing and weakens informed consent.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Historical price data (daily)
curl "https://api.aisa.one/apis/v1/financial/prices?ticker=AAPL&interval=day&interval_multiplier=1&start_date=2025-01-01&end_date=2025-12-31" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Weekly price data

• Confidence: 78% confidence
• Finding: curl "https://api.aisa.one/apis/v1/financial/prices?ticker=AAPL&interval=day&interval_multiplier=1&start_date=2025-01-01&end_date=2025-12-31" \ -H "Authorization: Bearer $AISA_API_KEY" # Weekly pri

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Historical price data (daily)
curl "https://api.aisa.one/apis/v1/financial/prices?ticker=AAPL&interval=day&interval_multiplier=1&start_date=2025-01-01&end_date=2025-12-31" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Weekly price data

• Confidence: 78% confidence
• Finding: https://api.aisa.one/

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Screen for stocks matching criteria
curl -X POST "https://api.aisa.one/apis/v1/financial/search/stock" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"filters":{"pe_ratio":{"max":15},"revenue_growth":{"min":0.2}}}'

• Confidence: 82% confidence
• Finding: https://api.aisa.one/

VirusTotal

66/66 vendors flagged this skill as clean.