Security audit

Trend Forecast

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed trend-forecasting skill that calls AIsa-hosted APIs, with a documentation caveat that its Twitter/X wording is broader than the actual implementation.

Install only if you are comfortable sending forecast questions, derived search terms, gathered source data, and AISA_API_KEY-authenticated requests to AIsa and relayed providers. Avoid confidential research topics unless that external processing is acceptable, and do not rely on this skill for Twitter/X posting or engagement automation.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (38)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The core description of multi-signal trend forecasting is largely accurate: the script does combine prediction markets, Twitter/X sentiment, news, and stock data, and uses an LLM to synthesize a forecast with confidence scoring. However, the declared 'Use when' statement materially overstates the Twitter/X-related capabilities. The code performs Twitter/X search/sentiment retrieval only as one input to forecasting; it does not implement posting, engagement, or ongoing monitoring workflows. Its actual primary function is generating a one-off analytical forecast report from several data sources, not operating as a Twitter workflow skill. Permissions are not obviously contradicted by the snippet, but the behavioral framing is mismatched enough to flag.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README says to use the skill for 'X/Twitter research, monitoring, posting, or engagement workflows,' which is much broader than the stated 'multi-signal trend forecasting' purpose. This ambiguity can cause unintended invocation for general social-media work rather than narrowly scoped trend analysis.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill explicitly requires environment access, network access, and references file-writing automation, but it does not declare any explicit tool scope such as allowed-tools or permissions. That creates an avoidable over-privilege condition where an agent runtime may grant broader capabilities than users expect, increasing the chance of unintended outbound requests or local file writes.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest description is broad enough to encourage invocation for loosely related X/Twitter workflows beyond the concrete operations documented in the file. Overly broad invocation scope can cause an agent to route unrelated user tasks into a skill that transmits prompts and derived queries to third-party services, expanding data exposure beyond user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The instructions direct the agent to send the user query, source-specific derived queries, and synthesized signal data to third-party endpoints, but they do not require a clear user-facing disclosure or consent step. This is dangerous because sensitive topics, proprietary research questions, or internal analysis could be transmitted externally without the user's informed awareness.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 96% confidence
Finding: The cited URL is part of the query-decomposition call that transmits user content to an external LLM service. In context, the danger is privacy leakage and third-party processing of potentially sensitive prompts, especially because decomposition may reveal user intent in a normalized form.
Content: Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.
Use the AIsa LLM gateway to break the user's query into source-specific search terms.

bash
curl -X POST "https://api.aisa.one/v1/chat/completions" \ -H "Authorization: Bearer $AISA_API_KEY" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 96% confidence
Finding: The cited URL is part of the query-decomposition call that transmits user content to an external LLM service. In context, the danger is privacy leakage and third-party processing of potentially sensitive prompts, especially because decomposition may reveal user intent in a normalized form.
Content: Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.
Use the AIsa LLM gateway to break the user's query into source-specific search terms.

bash
curl -X POST "https://api.aisa.one/v1/chat/completions" \ -H "Authorization: Bearer $AISA_API_KEY" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: This step transmits a derived prediction-market search query to an external API. While lower sensitivity than raw prompts in many cases, derived queries can still expose confidential research focus, strategic intent, or internal topics when routed off-platform without explicit notice.
Content: Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.
bash
# 1. Find Polymarket markets (params: search, status, market_slug, limit) curl "https://api.aisa.one/apis/v1/polymarket/markets?search=<PREDICTION_MARKET_QUERY>&status=open&limit=5" \ -H "Authorization: Bearer $AISA_API_KEY" # 2. Price a token (token_id = side_a.id or side_b.id from step 1)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 72% confidence
Finding: This request retrieves pricing data using a token ID obtained from a previous response and generally does not transmit fresh user-provided content. It still represents outbound network activity, but the direct privacy/security risk is lower than calls that send raw or derived user queries.
Content: Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.
-H "Authorization: Bearer $AISA_API_KEY"

2. Price a token (token_id = side_a.id or side_b.id from step 1)

curl "https://api.aisa.one/apis/v1/polymarket/market-price/<TOKEN_ID>"
-H "Authorization: Bearer $AISA_API_KEY"

text

External Transmission

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: This call sends a derived search query to Kalshi via AIsa's API surface, exposing the subject the user is investigating. In context, the skill is designed to do this, but the absence of prominent disclosure means users may not realize their research topic is being transmitted externally.
Content: Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.
For Kalshi, the flow is the same but keyed on market_ticker:

bash
curl "https://api.aisa.one/apis/v1/kalshi/markets?search=<PREDICTION_MARKET_QUERY>&limit=5" \ -H "Authorization: Bearer $AISA_API_KEY" curl "https://api.aisa.one/apis/v1/kalshi/market-price/<MARKET_TICKER>" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 71% confidence
Finding: This pricing lookup uses a market ticker rather than direct user input, so its standalone privacy impact is limited. The main concern is still undeclared outbound activity within a skill that lacks tight permission scoping.
Content: Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.
curl "https://api.aisa.one/apis/v1/kalshi/markets?search=<PREDICTION_MARKET_QUERY>&limit=5"
-H "Authorization: Bearer $AISA_API_KEY"

curl "https://api.aisa.one/apis/v1/kalshi/market-price/<MARKET_TICKER>"
-H "Authorization: Bearer $AISA_API_KEY"

text

External Transmission

Medium

Category: Data Exfiltration
Confidence: 95% confidence
Finding: This step sends a topic-specific Twitter/X search query to an external service. For sensitive topics, the query itself can reveal internal interests, monitoring targets, or reputational concerns, and the skill does not present a clear warning that such monitoring terms are shared with third parties.
Content: Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.
queryType (Latest or Top).

bash
curl "https://api.aisa.one/apis/v1/twitter/tweet/advanced_search?query=<TWITTER_QUERY>&queryType=Latest" \ -H "Authorization: Bearer $AISA_API_KEY"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: The Tavily search request transmits a derived news query and returns externally sourced material for synthesis. This is a legitimate feature, but it still creates a data-sharing risk when a user's research topic or investigative focus is sent off-system without explicit informed consent.
Content: Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.
Use AIsa's Tavily relay to search recent news articles about the topic.

bash
curl -X POST "https://api.aisa.one/apis/v1/tavily/search" \ -H "Authorization: Bearer $AISA_API_KEY" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 74% confidence
Finding: This request sends a stock ticker to an external financial endpoint. A ticker alone is often low sensitivity, but in some enterprise contexts it can still reveal trading interest or internal research focus when combined with the broader workflow.
Content: Scanner excerpt · SKILL.md (reported line 197)May include surrounding context.
bash
# Historical prices (interval is required: day, week, month, etc.) curl "https://api.aisa.one/apis/v1/financial/prices?ticker=<STOCK_SYMBOL>&interval=day" \ -H "Authorization: Bearer $AISA_API_KEY" # Real-time financial metrics snapshot

External Transmission

Medium

Category: Data Exfiltration
Confidence: 74% confidence
Finding: This metrics snapshot call transmits only the selected ticker, so its direct impact is relatively low. The primary concern is not the endpoint itself but the cumulative undisclosed external sharing across the workflow.
Content: Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.
md
-H "Authorization: Bearer $AISA_API_KEY" # Real-time financial metrics snapshot curl "https://api.aisa.one/apis/v1/financial/financial-metrics/snapshot?ticker=<STOCK_SYMBOL>" \ -H "Authorization: Bearer $AISA_API_KEY" # Company news

External Transmission

Medium

Category: Data Exfiltration
Confidence: 74% confidence
Finding: This company news lookup also transmits only the ticker, making it lower risk than raw-query endpoints. However, it still contributes to the skill's pattern of third-party data exchange without a clear user warning.
Content: Scanner excerpt · SKILL.md (reported line 205)May include surrounding context.
-H "Authorization: Bearer $AISA_API_KEY"

Company news

curl "https://api.aisa.one/apis/v1/financial/news?ticker=<STOCK_SYMBOL>"
-H "Authorization: Bearer $AISA_API_KEY"

text

External Transmission

Medium

Category: Data Exfiltration
Confidence: 97% confidence
Finding: The synthesis step sends aggregated signals, topic summary, and derived analysis context to AIsa's LLM gateway. This can be more sensitive than any single source query because it packages the user's topic, extracted market signals, and interpretive context into one external prompt, increasing disclosure and retention risk.
Content: Scanner excerpt · SKILL.md (reported line 222)May include surrounding context.
Pass all gathered signals to the AIsa LLM gateway for synthesis.

bash
curl -X POST "https://api.aisa.one/v1/chat/completions" \ -H "Authorization: Bearer $AISA_API_KEY" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.
md
Every endpoint the skill touches, documented from the actual calls in `scripts/aisa_client.py`. - **REST base URL:** `https://api.aisa.one/apis/v1` - **LLM base URL:** `https://api.aisa.one/v1` (OpenAI-compatible — note: **no** `/apis`) - **Auth header:** `Authorization: Bearer $AISA_API_KEY` on every request

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.
md
Every endpoint the skill touches, documented from the actual calls in `scripts/aisa_client.py`. - **REST base URL:** `https://api.aisa.one/apis/v1` - **LLM base URL:** `https://api.aisa.one/v1` (OpenAI-compatible — note: **no** `/apis`) - **Auth header:** `Authorization: Bearer $AISA_API_KEY` on every request

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api_endpoints.md (reported line 6)May include surrounding context.
md
Every endpoint the skill touches, documented from the actual calls in `scripts/aisa_client.py`. - **REST base URL:** `https://api.aisa.one/apis/v1` - **LLM base URL:** `https://api.aisa.one/v1` (OpenAI-compatible — note: **no** `/apis`) - **Auth header:** `Authorization: Bearer $AISA_API_KEY` on every request

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api_endpoints.md (reported line 7)May include surrounding context.
md
Every endpoint the skill touches, documented from the actual calls in `scripts/aisa_client.py`. - **REST base URL:** `https://api.aisa.one/apis/v1` - **LLM base URL:** `https://api.aisa.one/v1` (OpenAI-compatible — note: **no** `/apis`) - **Auth header:** `Authorization: Bearer $AISA_API_KEY` on every request

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api_endpoints.md (reported line 14)May include surrounding context.
md
Every endpoint the skill touches, documented from the actual calls in `scripts/aisa_client.py`. - **REST base URL:** `https://api.aisa.one/apis/v1` - **LLM base URL:** `https://api.aisa.one/v1` (OpenAI-compatible — note: **no** `/apis`) - **Auth header:** `Authorization: Bearer $AISA_API_KEY` on every request

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api_endpoints.md (reported line 68)May include surrounding context.
md
Every endpoint the skill touches, documented from the actual calls in `scripts/aisa_client.py`. - **REST base URL:** `https://api.aisa.one/apis/v1` - **LLM base URL:** `https://api.aisa.one/v1` (OpenAI-compatible — note: **no** `/apis`) - **Auth header:** `Authorization: Bearer $AISA_API_KEY` on every request

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: This finding overlaps the concrete curl example that posts chat messages to an external API. Unlike the generic URL mentions, this line demonstrates actual outbound transmission of prompt content and therefore represents a real data-exposure risk in the absence of warning, consent, or sanitization controls.
Content: Scanner excerpt · references/api_endpoints.md (reported line 22)May include surrounding context.
| POST | /v1/chat/completions | Standard OpenAI chat completions | ~$0.01–0.05 (model-dependent) |

bash
curl -X POST "https://api.aisa.one/v1/chat/completions" \ -H "Authorization: Bearer $AISA_API_KEY" \ -H "Content-Type: application/json" \ -d '{"model": "gpt-4.1-mini", "messages": [...], "temperature": 0.3}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: This finding overlaps the concrete curl example that posts chat messages to an external API. Unlike the generic URL mentions, this line demonstrates actual outbound transmission of prompt content and therefore represents a real data-exposure risk in the absence of warning, consent, or sanitization controls.
Content: Scanner excerpt · references/api_endpoints.md (reported line 22)May include surrounding context.
| POST | /v1/chat/completions | Standard OpenAI chat completions | ~$0.01–0.05 (model-dependent) |

bash
curl -X POST "https://api.aisa.one/v1/chat/completions" \ -H "Authorization: Bearer $AISA_API_KEY" \ -H "Content-Type: application/json" \ -d '{"model": "gpt-4.1-mini", "messages": [...], "temperature": 0.3}'

Static analysis

No suspicious patterns detected.

Overview

A.I.G

SkillSpector

Tp4

Vague Triggers

Undeclared Tool Scope

Vague Triggers

Missing User Warnings

External Transmission

External Transmission

External Transmission

External Transmission

2. Price a token (token_id = side_a.id or side_b.id from step 1)

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

Company news

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

Static analysis