Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Perplexity/AIsa search client, with external API use and API-key access clearly tied to its stated purpose.
Install this only if you intend to use AIsa/Perplexity search and are comfortable sending your query text, optional system prompt, and AISA_API_KEY-authenticated requests to api.aisa.one. Avoid submitting secrets or confidential data unless that is approved for your environment.
The skill clearly requires environment access to read AISA_API_KEY and network access to send prompts to api.aisa.one, but it does not declare an explicit tool scope such as permissions or allowed-tools. That gap weakens reviewability and policy enforcement because users and orchestrators cannot easily see or constrain the skill's external capabilities before use.
The documentation instructs users to send queries and optional system prompts to a third-party API, but it does not prominently warn that user content will leave the local environment. This can cause accidental disclosure of sensitive prompts, internal data, or regulated information to an external service without informed consent.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
--system "Respond in markdown with an executive summary first."
## Curl Examples
### Sonar
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class PerplexitySearchClient:
"""Minimal client for AIsa Perplexity Sonar endpoints."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
self.api_key = api_key or os.environ.get("AISA_API_KEY")
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class PerplexitySearchClient:
"""Minimal client for AIsa Perplexity Sonar endpoints."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
self.api_key = api_key or os.environ.get("AISA_API_KEY")
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class PerplexitySearchClient:
"""Minimal client for AIsa Perplexity Sonar endpoints."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
self.api_key = api_key or os.environ.get("AISA_API_KEY")
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class PerplexitySearchClient:
"""Minimal client for AIsa Perplexity Sonar endpoints."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
self.api_key = api_key or os.environ.get("AISA_API_KEY")
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class PerplexitySearchClient:
"""Minimal client for AIsa Perplexity Sonar endpoints."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
self.api_key = api_key or os.environ.get("AISA_API_KEY")
This code constructs a request body from the user-provided query and optional system prompt, then posts it to an external HTTPS endpoint. Although the file purpose implies search functionality, there is no explicit disclosure in the CLI help, docstring, or runtime output that user-supplied content will be transmitted to a remote service.
No suspicious patterns detected.