aisa financial data api

PassAudited by ClawScan on May 1, 2026.

Overview

This skill appears to be a straightforward market-data API client, but users should be aware it sends an AISA API key to the external AIsa service and comes from an unknown source.

This skill looks benign for querying financial market data. Before installing, make sure you trust the AIsa service and the unknown-source publisher with your AISA API key, use a dedicated key if possible, and avoid sending query details you consider sensitive.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Anyone installing the skill must trust the AIsa API service with their API key, and API usage may count against the user's quota or billing plan.

Why it was flagged

The helper client sends the configured AISA_API_KEY as a bearer token to the AIsa API. This is expected for the stated market-data service, but it is still credential use.

Skill content
"Authorization": f"Bearer {self.api_key}"
Recommendation

Use a dedicated AISA API key with the least privileges available, monitor usage, and rotate the key if it is exposed.

What this means

The agent can perform market-data lookups against the external API when invoked, which may reveal queried symbols or analysis interests to the provider.

Why it was flagged

The skill teaches the agent to make direct external API calls with user-selected tickers, dates, and filters. This is central to the skill's purpose and does not show destructive or unrelated actions.

Skill content
curl "https://api.aisa.one/apis/v1/financial/prices?ticker=AAPL&interval=day&interval_multiplier=1&start_date=2025-01-01&end_date=2025-12-31"
Recommendation

Only ask the skill to query symbols and date ranges you are comfortable sending to the AIsa API.

What this means

Users have less independent context for who maintains the skill and how updates are produced.

Why it was flagged

The registry metadata does not identify a source repository or package provenance. No risky install commands are shown, but unknown provenance is still worth noticing.

Skill content
Source: unknown
Recommendation

Prefer installing from publishers and source locations you trust, and review updates before relying on the skill for important analysis.