Security audit
Security checks for vulnerabilities and agentic risk
MarketPulse is a disclosed financial-data lookup skill that sends requested market queries to the AISA API using the user's API key, with no hidden persistence or local data access found.
Install only if you are comfortable sending market research requests, ticker lists, dates, screening filters, and your AISA bearer token to api.aisa.one. Avoid using confidential trading strategies or sensitive internal watchlists unless that third-party service is approved for your environment.
The skill declares required environment variables and clearly relies on network access, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates an authorization gap where a host or reviewer cannot easily enforce least privilege, increasing the chance the skill runs with broader capabilities than intended.
The skill references the external domain api.aisa.one as part of its core operation, confirming that user requests are sent to an outside service. This is not inherently malicious, but it is a genuine external transmission surface that should be transparently disclosed and constrained.
# Historical price data (daily)
curl "https://api.aisa.one/apis/v1/financial/prices?ticker=AAPL&interval=day&interval_multiplier=1&start_date=2025-01-01&end_date=2025-12-31" \
-H "Authorization: Bearer $AISA_API_KEY"
# Weekly price data
The skill references the external domain api.aisa.one as part of its core operation, confirming that user requests are sent to an outside service. This is not inherently malicious, but it is a genuine external transmission surface that should be transparently disclosed and constrained.
# Historical price data (daily)
curl "https://api.aisa.one/apis/v1/financial/prices?ticker=AAPL&interval=day&interval_multiplier=1&start_date=2025-01-01&end_date=2025-12-31" \
-H "Authorization: Bearer $AISA_API_KEY"
# Weekly price data
This documented request sends authenticated stock query data to api.aisa.one, creating a routine but real data egress path. The risk is contextual rather than exploit-specific: user research activity and API credentials are involved in every call.
-H "Authorization: Bearer $AISA_API_KEY"
# Weekly price data
curl "https://api.aisa.one/apis/v1/financial/prices?ticker=AAPL&interval=week&interval_multiplier=1&start_date=2025-01-01&end_date=2025-12-31" \
-H "Authorization: Bearer $AISA_API_KEY"
# Minute-level data (intraday)
The intraday price example transmits authenticated market queries to an external provider. Such requests may reveal trading timing interests or analysis behavior, so this is a valid egress concern even though it aligns with the skill's purpose.
-H "Authorization: Bearer $AISA_API_KEY"
curl "https://api.aisa.one/apis/v1/financial/prices?ticker=AAPL&interval=minute&interval_multiplier=5&start_date=2025-01-15&end_date=2025-01-15"
-H "Authorization: Bearer $AISA_API_KEY"
The company news example sends a ticker and authorization token to a third-party service. In context this is expected behavior, but it still constitutes data transfer to an external party and should be treated as such.
# Get news by ticker
curl "https://api.aisa.one/apis/v1/financial/news?ticker=AAPL&limit=10" \
-H "Authorization: Bearer $AISA_API_KEY"
This financial statements request is an authenticated outbound call to api.aisa.one. The main risk is privacy and governance rather than code execution: user lookups and usage patterns are sent to an external service.
# All financial statements
curl "https://api.aisa.one/apis/v1/financial/financial_statements/all?ticker=AAPL" \
-H "Authorization: Bearer $AISA_API_KEY"
# Income statements
The income statement example performs external transmission of query data and credentials to a third-party API. This is ordinary for API-backed skills, but still a real security-relevant egress channel.
-H "Authorization: Bearer $AISA_API_KEY"
# Income statements
curl "https://api.aisa.one/apis/v1/financial/financial_statements/income?ticker=AAPL" \
-H "Authorization: Bearer $AISA_API_KEY"
# Balance sheets
This balance sheet lookup sends authenticated traffic to an external service. The danger is moderate because the API key and user-requested symbols leave the local environment, even though no obviously sensitive local files are accessed.
-H "Authorization: Bearer $AISA_API_KEY"
# Balance sheets
curl "https://api.aisa.one/apis/v1/financial/financial_statements/balance?ticker=AAPL" \
-H "Authorization: Bearer $AISA_API_KEY"
# Cash flow statements
The cash flow request is another authenticated egress path to api.aisa.one. It is consistent with the skill's stated purpose, but users should still be informed that their request parameters and usage are visible to the service provider.
-H "Authorization: Bearer $AISA_API_KEY"
curl "https://api.aisa.one/apis/v1/financial/financial_statements/cash?ticker=AAPL"
-H "Authorization: Bearer $AISA_API_KEY"
This metrics snapshot example transmits a ticker and bearer token to an external provider. The issue is not hidden malware behavior, but undisclosed or under-scoped external data transfer.
# Real-time financial metrics snapshot
curl "https://api.aisa.one/apis/v1/financial/financial-metrics/snapshot?ticker=AAPL" \
-H "Authorization: Bearer $AISA_API_KEY"
# Historical financial metrics
Historical financial metrics requests are sent to a third-party API with authentication. That creates a legitimate but security-relevant dependency on external transmission and secret handling.
-H "Authorization: Bearer $AISA_API_KEY"
curl "https://api.aisa.one/apis/v1/financial/financial-metrics?ticker=AAPL"
-H "Authorization: Bearer $AISA_API_KEY"
The analyst estimates example shows external authenticated queries to api.aisa.one. This can expose user research subjects and request history to the provider, so it should be treated as a true egress finding.
# Earnings per share estimates
curl "https://api.aisa.one/apis/v1/financial/analyst/eps?ticker=AAPL&period=annual" \
-H "Authorization: Bearer $AISA_API_KEY"
This insider trades lookup sends query data and authentication to an external service. In some environments, the topic being researched could itself be sensitive, making transparency and scoping important.
# Get insider trades
curl "https://api.aisa.one/apis/v1/financial/insider/trades?ticker=AAPL" \
-H "Authorization: Bearer $AISA_API_KEY"
The institutional ownership request is another outbound authenticated API call. The external transmission is expected but remains a real security concern because user interest data and an access token are shared with a third party.
# Get institutional ownership
curl "https://api.aisa.one/apis/v1/financial/institutional/ownership?ticker=AAPL" \
-H "Authorization: Bearer $AISA_API_KEY"
This SEC filings example transmits requested company data and credentials to api.aisa.one. The context makes the activity legitimate, but not risk-free: it still creates an observable external research trail.
# Get SEC filings
curl "https://api.aisa.one/apis/v1/financial/sec/filings?ticker=AAPL" \
-H "Authorization: Bearer $AISA_API_KEY"
# Get SEC filing items
The SEC items request is an authenticated external transmission. Even though the data requested is public-market information, the user’s pattern of access and authorization secret are still security-relevant.
-H "Authorization: Bearer $AISA_API_KEY"
curl "https://api.aisa.one/apis/v1/financial/sec/items?ticker=AAPL"
-H "Authorization: Bearer $AISA_API_KEY"
The company facts lookup sends ticker-based requests and a bearer token to a remote service. This is functionally necessary but should still be explicitly declared and constrained.
# Get company facts by CIK
curl "https://api.aisa.one/apis/v1/financial/company/facts?ticker=AAPL" \
-H "Authorization: Bearer $AISA_API_KEY"
The stock screener POST request can transmit richer user-defined filters and analysis criteria to the external API, potentially revealing proprietary investment strategy or internal screening logic. That makes this egress path slightly more sensitive than simple ticker lookups.
# Screen for stocks matching criteria
curl -X POST "https://api.aisa.one/apis/v1/financial/search/stock" \
-H "Authorization: Bearer $AISA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"filters":{"pe_ratio":{"max":15},"revenue_growth":{"min":0.2}}}'
This interest rates snapshot example performs an authenticated outbound request to api.aisa.one. The transmitted content is low sensitivity here, but the general external transmission and secret exposure considerations still apply.
# Current interest rates
curl "https://api.aisa.one/apis/v1/financial/interest_rates/snapshot" \
-H "Authorization: Bearer $AISA_API_KEY"
# Historical interest rates
The historical interest rates request sends query data and the API key to an external provider. This is expected behavior for the skill, yet still a genuine egress channel requiring disclosure and least-privilege controls.
-H "Authorization: Bearer $AISA_API_KEY"
curl "https://api.aisa.one/apis/v1/financial/interest_rates/historical?bank=fed"
-H "Authorization: Bearer $AISA_API_KEY"
The crypto snapshot example transmits the requested ticker and authentication token to a third-party API. Crypto watchlists and request patterns may be sensitive in some operational contexts, so the external transmission is security-relevant.
# Get current BTC price (use ticker format: SYMBOL-USD)
curl "https://api.aisa.one/apis/v1/financial/crypto/prices/snapshot?ticker=BTC-USD" \
-H "Authorization: Bearer $AISA_API_KEY"
# Get current ETH price
This ETH snapshot request is an authenticated external call. It matches the skill’s purpose, but still exposes user query activity and the bearer token to the service provider.
-H "Authorization: Bearer $AISA_API_KEY"
# Get current ETH price
curl "https://api.aisa.one/apis/v1/financial/crypto/prices/snapshot?ticker=ETH-USD" \
-H "Authorization: Bearer $AISA_API_KEY"
# Get current SOL price
The SOL snapshot example demonstrates another external data egress path using the user's API key. The risk is moderate because the skill is designed for this behavior, but the documentation does not pair it with strong privacy or permission scoping guidance.
-H "Authorization: Bearer $AISA_API_KEY"
# Get current SOL price
curl "https://api.aisa.one/apis/v1/financial/crypto/prices/snapshot?ticker=SOL-USD" \
-H "Authorization: Bearer $AISA_API_KEY"
# Get TRUMP token price
The TRUMP token snapshot request is still just an authenticated third-party API call, but queries involving politically themed or speculative assets may be especially sensitive from a privacy or reputational perspective. This slightly increases the contextual sensitivity of the egress path.
-H "Authorization: Bearer $AISA_API_KEY"
curl "https://api.aisa.one/apis/v1/financial/crypto/prices/snapshot?ticker=TRUMP-USD"
-H "Authorization: Bearer $AISA_API_KEY"
No suspicious patterns detected.