AIsa Youtube Serp Scout

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:02 AM UTC
• Version: 1.0.2

Overview

This skill is a disclosed YouTube search client that sends user searches and an AIsa API key to the AIsa API, with no evidence of hidden persistence, local data harvesting, or unrelated behavior.

Install only if you are comfortable sending YouTube research queries and your AISA_API_KEY to api.aisa.one. Use a dedicated, revocable, least-privilege AIsa key where possible, and rotate it if you suspect exposure; client maintainers should add strict same-origin redirect handling for authenticated requests.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/youtube_client.py:50

Finding

Bearer API Key May Be Disclosed Through Cross-Origin HTTP Redirects

Content

View full analysis

Vulnerability Details

File Location: scripts/youtube_client.py, lines 50–69
Vulnerability Type: Bearer credential exposure through unrestricted redirects
Risk Level: Medium

python

headers = {
    "Authorization": f"Bearer {self.api_key}",
    "Content-Type": "application/json",
    "User-Agent": "AIsa-YouTube/1.0",
    "Accept": "application/json"
}

request_data = None
if data:
    request_data = json.dumps(data).encode("utf-8")

if method == "POST" and request_data is None:
    request_data = b"{}"

req = urllib.request.Request(url, data=request_data, headers=headers, method=method)

try:
    with urllib.request.urlopen(req, timeout=60) as response:

Technical Analysis

The client places AISA_API_KEY in the HTTP Authorization header and submits the request through urllib.request.urlopen. The standard URL opener handles HTTP redirects automatically, while this implementation does not enforce a same-origin redirect policy or explicitly remove credentials when the destination origin changes.

Consequently, a redirect returned by api.aisa.one could cause a follow-up request containing the bearer credential to be sent to another host. Exploitation requires influence over the API endpoint or its redirect behavior; ordinary untrusted search input cannot directly choose the destination because BASE_URL and the invoked endpoint are fixed.

Transmission of the API key to the original HTTPS API is documented in SKILL.md and is necessary for the declared relay-based YouTube search functionality. The issue is therefore not the initial credential transmission, but the absence of a strict redirect boundary around that transmission.

Attack Path

1. A user invokes one of the documented search or competitor-research commands.
2. The client reads AISA_API_KEY and sends it to https://api.aisa.one as a bearer token.
3. An attacker who has compromised or ...[truncated 965 chars]

Remediation

View remediation

Remediation Suggestions

• Disable automatic redirects for authenticated requests and handle redirect responses explicitly.
• If redirects are operationally required, parse and normalize every redirect destination and permit it only when:
  • the scheme remains https;
  • the normalized hostname is exactly api.aisa.one;
  • the effective port is the expected HTTPS port; and
  • user-information and other ambiguous URL components are absent.
• Reject redirects to any other origin rather than forwarding the bearer token.
• Construct a fresh redirected request instead of reusing headers. Add Authorization only after the destination passes the same-origin validation.
• Set a conservative maximum redirect count to prevent redirect loops.
• Consider using a narrowly scoped and revocable API key. Rotate the key immediately if redirect-based disclosure is suspected.
• Add automated tests covering same-origin redirects, cross-origin redirects, HTTPS-to-HTTP downgrades, hostname normalization, and confirmation that credentials are absent from rejected or external requests.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill requires both environment access to AISA_API_KEY and outbound network access to api.aisa.one, but it does not explicitly declare a tool scope such as permissions or allowed-tools. That omission weakens least-privilege controls and makes it harder for a host agent or reviewer to understand and constrain what the skill can access before execution.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 86% confidence

Finding

This skill is designed to send user queries and an API bearer token to the third-party endpoint api.aisa.one, which is an external data transmission boundary. While this is expected functionality, it still creates a real confidentiality and trust risk because user research queries and the AISA_API_KEY are exposed to an external service outside the local agent environment.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

## Quick Reference

- Required environment variable: `AISA_API_KEY`
- Endpoint: `https://api.aisa.one/apis/v1/youtube/search`
- Python client: `scripts/youtube_client.py`

## Setup

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The example command explicitly demonstrates transmitting Authorization: Bearer $AISA_API_KEY to api.aisa.one, confirming external exfiltration of a secret to a third-party service as part of normal operation. Even if intentional, this increases risk if the endpoint is compromised, misconfigured, or used in environments where external transmission of credentials or query content is not acceptable.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

Common Commands

bash

curl "https://api.aisa.one/apis/v1/youtube/search?engine=youtube&q=AI+agents+tutorial" \
  -H "Authorization: Bearer $AISA_API_KEY"

python3 scripts/youtube_client.py search --query "AI agents tutorial"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/youtube_client.py (reported line 24)May include surrounding context.

python

class YouTubeClient:
    """AIsa YouTube - YouTube SERP Scout API Client."""
    
    BASE_URL = "https://api.aisa.one/apis/v1"
    
    def __init__(self, api_key: Optional[str] = None):
        """Initialize the client with an API key."""

Static analysis

No suspicious patterns detected.